PT-2021-19731

CVE-2021-32506

·

Published

2021-07-07

·

Updated

2021-09-20

Description by

CVSS 3.1
6.5
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3
Description: The issue allows remote authenticated attackers to download arbitrary files due to an Absolute Path Traversal vulnerability in the GetImage function. This is achieved by manipulating the Url path parameter.
Recommendations: For versions prior to 3.3.3, update to version 3.3.3 to resolve the issue.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-36: Absolute Path Traversal
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2021-32506
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com