CVE-2021-32526

Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password files. Suggest contacting with QSAN and refer to recommendations in QSAN Document.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-4882-c0310-1.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:qsan:storage_manager:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-07-07 14:15

Updated : 2021-09-20 12:35

NVD link : CVE-2021-32526

Mitre link : CVE-2021-32526

CVE.ORG link : CVE-2021-32526

JSON object : View

Products Affected

qsan

storage_manager

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2021-32526", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-07-07T14:15:11.467", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-4882-c0310-1.html", "tags": ["Vendor Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}, {"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password files. Suggest contacting with QSAN and refer to recommendations in QSAN Document."}, {"lang": "es", "value": "La asignaci\u00f3n incorrecta de permisos para la vulnerabilidad de los recursos cr\u00edticos en QSAN Storage Manager permite a los atacantes remotos autenticados acceder a archivos con contrase\u00f1as arbitrarias. Se sugiere contactar con QSAN y consultar las recomendaciones del documento de QSAN"}], "lastModified": "2021-09-20T12:35:55.503", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qsan:storage_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CE2A478-5140-4734-B1BA-0AB2741ADBB4", "versionEndIncluding": "3.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}