Lucene search

QnapCVE-2017-7638

HistoryMar 08, 2018 - 2:29 p.m.

CVE-2017-7638

2018-03-0814:29:00

CWE-287

qnap

web.nvd.nist.gov

qnap

nas

media streaming

add-on

cve-2017-7638

authentication

settings change

information leakage

vulnerability

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

34.4%

JSON

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS.

Affected configurations

Nvd

Node

qnapmedia_streaming_add-onRange≤430.1.2.0

AND

qnapqtsMatch4.3.3

Node

qnapmedia_streaming_add-onRange≤421.1.0.2

AND

qnapqtsRange≤4.2.6

VendorProductVersionCPE
qnapmedia_streaming_add-on*cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*
qnapqts4.3.3cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*
qnapqts*cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	media_streaming_add-on	*	cpe:2.3:a:qnap:media_streaming_add-on::::::::
qnap	qts	4.3.3	cpe:2.3:o:qnap:qts:4.3.3:::::::*
qnap	qts	*	cpe:2.3:o:qnap:qts::::::::

CNA Affected

[
  {
    "product": "QNAP Media Streaming Add-On",
    "vendor": "QNAP",
    "versions": [
      {
        "status": "affected",
        "version": "421.1.0.2, 430.1.2.0, and earlier"
      }
    ]
  }
]

References

www.qnap.com/zh-tw/security-advisory/nas-201803-08

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

34.4%

JSON

Related for CVE-2017-7638