title: QSAN Storage Manager - Incorrect Permission Assignment for Critical Resource
description: Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password files. Suggest contacting with QSAN and refer to recommendations in QSAN Document.
problem types: CWE-732 Incorrect Permission Assignment for Critical Resource
affected:
{
product: Storage Manager
vendor: QSAN
versions:
lessThanOrEqual: 3.3.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: QSAN Storage Manager v3.3.3