Lucene search

[email protected]CVE-2024-21900

HistoryMar 08, 2024 - 5:15 p.m.

CVE-2024-21900

2024-03-0817:15:22

CWE-74

[email protected]

web.nvd.nist.gov

cve-2024-21900

qnap

qts

quts hero

qutscloud

injection vulnerability

network security

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

7.8 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.0005 Low

EPSS

Percentile

15.6%

JSON

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later
QuTScloud c5.1.5.2651 and later

CPENameOperatorVersion
qnap:qtsqnap qtslt5.1.3.2578
qnap:qtsqnap qtseq5.1.0.2348
qnap:qtsqnap qtseq4.5.4.2012
qnap:qtsqnap qtseq4.3.5
qnap:qtsqnap qtseq4.3.3.1799
qnap:qtsqnap qtseq4.3.3.1051
qnap:qtsqnap qtseq4.3.3.1252
qnap:qtsqnap qtseq4.3.6
qnap:qtsqnap qtseq4.5.3
qnap:qtsqnap qtseq4.5.4.1741

CPE	Name	Operator	Version
qnap:qts	qnap qts	lt	5.1.3.2578
qnap:qts	qnap qts	eq	5.1.0.2348
qnap:qts	qnap qts	eq	4.5.4.2012
qnap:qts	qnap qts	eq	4.3.5
qnap:qts	qnap qts	eq	4.3.3.1799
qnap:qts	qnap qts	eq	4.3.3.1051
qnap:qts	qnap qts	eq	4.3.3.1252
qnap:qts	qnap qts	eq	4.3.6
qnap:qts	qnap qts	eq	4.5.3
qnap:qts	qnap qts	eq	4.5.4.1741

Rows per page:

1-10 of 3021

References

www.qnap.com/en/security-advisory/qsa-24-09

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

7.8 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.0005 Low

EPSS

Percentile

15.6%

JSON

Related for CVE-2024-21900

cvelist1 prion1 openvas3