{"id":"CVE-2021-32523","state":"PUBLISHED","title":"QSAN Storage Manager - Improper Authorization","description":"Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document.","publishedAt":"2021-07-07T14:12:06.570Z","updatedAt":"2024-09-16T23:45:28.851Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"twcert"},"assigner":"twcert","products":["QSAN Storage Manager"],"affected":[{"vendor":"QSAN","product":"Storage Manager","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"3.3.1","versionType":"custom"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-4879-01616-1.html"],"weaknesses":["CWE-285"],"ingestedAt":"2026-10-29T19:48:33.225Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/32xxx/CVE-2021-32523.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-32523","state":"PUBLISHED","datePublished":"2021-07-07T14:12:06.570Z","dateUpdated":"2024-09-16T23:45:28.851Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2021-05-10T00:00:00.000Z"},"containers":{"cna":{"title":"QSAN Storage Manager - Improper Authorization","descriptions":[{"lang":"en","value":"Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document."}],"affected":[{"vendor":"QSAN","product":"Storage Manager","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"3.3.1","versionType":"custom"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-4879-01616-1.html","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","description":"CWE-285 Improper Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","dateUpdated":"2021-07-22T10:32:49.000Z","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e"},"datePublic":"2021-07-07T00:00:00.000Z","solutions":[{"lang":"en","value":"Please refer to QSANS's recommended measures"}],"source":{"advisory":"TVN-202104028","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"AKA":"TWCERT/CC","ASSIGNER":"cve@cert.org.tw","DATE_PUBLIC":"2021-07-07T12:19:00.000Z","ID":"CVE-2021-32523","STATE":"PUBLIC","TITLE":"QSAN Storage Manager - Improper Authorization"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Storage Manager","version":{"version_data":[{"version_affected":"<=","version_value":"3.3.1"}]}}]},"vendor_name":"QSAN"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-285 Improper Authorization"}]}]},"references":{"reference_data":[{"name":"https://www.twcert.org.tw/tw/cp-132-4879-01616-1.html","refsource":"MISC","url":"https://www.twcert.org.tw/tw/cp-132-4879-01616-1.html"}]},"solution":[{"lang":"en","value":"Please refer to QSANS's recommended measures"}],"source":{"advisory":"TVN-202104028","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.twcert.org.tw/tw/cp-132-4879-01616-1.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T23:25:29.959Z"}}]}}}