Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Reflected XSS Vulnerability in TFTP (QNAP Systems Inc. QuTS hero)

CVE-2021-38674
MEDIUM 4.2

At a glance

Source
NVD
EPSS
EPSS 0.66 % · percentile 51 ()
State
PUBLISHED
Published
Updated
Assigner
qnap
NVD status
Modified

Search on…

Description

A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later

Weaknesses (CWE)

  • CWE-79 — Improper Neutralization of Input During Web Page Generation

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 4.2CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Nqnap
CVSS 3.1MEDIUM 4.2CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NNVD · security@qnapsecurity.com.tw (Secondary)
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 4.3AV:N/AC:M/Au:N/C:N/I:P/A:NNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
QNAP Systems Inc. · QuTS heroaffected unspecified < h4.5.4.1771 build 20210825
QNAP Systems Inc. · QTSaffected unspecified < 4.5.4.1787 build 20210910
QNAP Systems Inc. · QuTScloudaffected unspecified < c4.5.7.1864

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD