Reflected XSS Vulnerability in TFTP (QNAP Systems Inc. QuTS hero)
En bref
- Source
- NVD
- EPSS
- EPSS 0.66 % · centile 51 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- qnap
- Statut NVD
- Modified
Description
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N | qnap |
| CVSS 3.1 | MEDIUM 4.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N | NVD · security@qnapsecurity.com.tw (Secondary) |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-25113
- GCVE · GCVE-0-2021-38674
Avis du CERT-FR
- CERTFR-2022-AVI-009 — Multiples vulnérabilités dans les produits QNAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*< 4.5.4.1787cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*< h4.5.4.1771cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*< c4.5.7.1864
Produits affectés
| Produit | Versions |
|---|---|
| QNAP Systems Inc. · QuTS hero | affected unspecified < h4.5.4.1771 build 20210825 |
| QNAP Systems Inc. · QTS | affected unspecified < 4.5.4.1787 build 20210910 |
| QNAP Systems Inc. · QuTScloud | affected unspecified < c4.5.7.1864 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |