CVE-2021-32519

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.2, QSAN XEVO v2.1.0, and QSAN SANOS v2.1.0.

CVSS v3 9.8 CRITICAL
CVSS v2.0 5.0 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-4875-692f0-1.html	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-4875-692f0-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:qsan:sanos::::::::
	cpe:2.3:a:qsan:storage_manager::::::::
	cpe:2.3:a:qsan:xevo::::::::

History

21 Nov 2024, 06:07

Type	Values Removed	Values Added
CVSS	v2 : ~~5.0~~ v3 : ~~7.5~~	v2 : 5.0 v3 : 9.8
References	~~() https://www.twcert.org.tw/tw/cp-132-4875-692f0-1.html - Third Party Advisory~~	() https://www.twcert.org.tw/tw/cp-132-4875-692f0-1.html - Third Party Advisory

Information

Published : 2021-07-07 14:15

Updated : 2024-11-21 06:07

NVD link : CVE-2021-32519

Mitre link : CVE-2021-32519

CVE.ORG link : CVE-2021-32519

JSON object : View

Products Affected

qsan

storage_manager
xevo
sanos

CWE

CWE-916

Use of Password Hash With Insufficient Computational Effort

{"id": "CVE-2021-32519", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-07-07T14:15:11.020", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-4875-692f0-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-4875-692f0-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-916"}]}], "descriptions": [{"lang": "en", "value": "Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.2, QSAN XEVO v2.1.0, and QSAN SANOS v2.1.0."}, {"lang": "es", "value": "La vulnerabilidad del uso del hash de la contrase\u00f1a con un esfuerzo computacional insuficiente en QSAN Storage Manager, XEVO, SANOS permite a los atacantes remotos recuperar la contrase\u00f1a de texto plano mediante la fuerza bruta del hash MD5. La vulnerabilidad referida ha sido resuelta con la versi\u00f3n actualizada de QSAN Storage Manager v3.3.2, QSAN XEVO v2.1.0, y QSAN SANOS v2.1.0"}], "lastModified": "2024-11-21T06:07:11.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qsan:sanos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85D922DA-3B01-496D-8362-1E0745AEA2BC", "versionEndExcluding": "2.1.0"}, {"criteria": "cpe:2.3:a:qsan:storage_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C3415DB-28CC-420A-9145-246A0E9952CE", "versionEndExcluding": "3.3.2"}, {"criteria": "cpe:2.3:a:qsan:xevo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B44B494-BE7E-4B21-841C-CED3EB89A81E", "versionEndExcluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}