Lucene search

QnapCVE-2017-7634

HistoryMar 08, 2018 - 2:29 p.m.

CVE-2017-7634

2018-03-0814:29:00

CWE-79

qnap

web.nvd.nist.gov

cve-2017-7634

cross-site scripting

xss

qnap nas

media streaming

vulnerability

nvd

security

html

web script

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

45.6%

JSON

Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page.

Affected configurations

Nvd

Node

qnapqtsMatch4.3.3

AND

qnapmedia_streaming_add-onRange≤430.1.2.0

Node

qnapqtsRange≤4.2.6

AND

qnapmedia_streaming_add-onRange≤421.1.0.2

VendorProductVersionCPE
qnapqts4.3.3cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*
qnapmedia_streaming_add-on*cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*
qnapqts*cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	qts	4.3.3	cpe:2.3:o:qnap:qts:4.3.3:::::::*
qnap	media_streaming_add-on	*	cpe:2.3:a:qnap:media_streaming_add-on::::::::
qnap	qts	*	cpe:2.3:o:qnap:qts::::::::

CNA Affected

[
  {
    "product": "QNAP Media Streaming Add-On",
    "vendor": "QNAP",
    "versions": [
      {
        "status": "affected",
        "version": "421.1.0.2, 430.1.2.0, and earlier"
      }
    ]
  }
]

References

www.qnap.com/zh-tw/security-advisory/nas-201803-08

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

45.6%

JSON

Related for CVE-2017-7634