Stored Cross-Site Scripting Vulnerability in QTS by QNAP
CVE-2019-7197
4.8MEDIUM
Summary
A stored cross-site scripting (XSS) vulnerability has been identified in multiple versions of QTS, potentially allowing an attacker to inject malicious scripts into the administrator console. This could lead to unauthorized actions being executed by the administrator, compromising the integrity of the system. To mitigate this risk, it is crucial for users to update their QTS to the latest version as provided by QNAP.
Affected Version(s)
QNAP NAS devices QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190919, QTS 4.3.4: before build 20190921, QTS 4.3.3: before build 20190921, QTS 4.2.6: before build 20190921
References
CVSS V3.1
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved