Cross-Site Scripting Vulnerability in QNAP Products

Summary

CVE-2023-23357 describes a critical cross-site scripting (XSS) vulnerability found in various QNAP QuLog Center operating system versions. Remote attackers with administrative access can exploit this flaw to bypass existing security mechanisms and potentially access sensitive application data. It is crucial for users of affected versions to update to the latest releases where this vulnerability has been resolved. QNAP has released patches in versions QuLog Center 1.5.0.738 (released on March 6, 2023), 1.4.1.691 (released on March 1, 2023), and 1.3.1.645 (released on February 22, 2023) to address this security concern. For further details and assistance, refer to QNAP's security advisory.

Refferences