Stored Cross-Site Scripting Vulnerability in QTS by QNAP
CVE-2019-7197

4.8MEDIUM

Key Information:

Vendor
Qnap
Status
Qnap Nas Devices
Vendor
CVE Published:
4 December 2019

Summary

A stored cross-site scripting (XSS) vulnerability has been identified in multiple versions of QTS, potentially allowing an attacker to inject malicious scripts into the administrator console. This could lead to unauthorized actions being executed by the administrator, compromising the integrity of the system. To mitigate this risk, it is crucial for users to update their QTS to the latest version as provided by QNAP.

Affected Version(s)

QNAP NAS devices QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190919, QTS 4.3.4: before build 20190921, QTS 4.3.3: before build 20190921, QTS 4.2.6: before build 20190921

References

https://www.qnap.com/zh-tw/security-advisory/nas-201911-26
x_refsource_CONFIRM

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.