Lucene search

QnapCVE-2021-28815

HistoryJun 16, 2021 - 4:15 a.m.

CVE-2021-28815

2021-06-1604:15:08

CWE-922

qnap

web.nvd.nist.gov

cve-2021-28815

insecure storage

sensitive information

qnap nas

myqnapcloud link

vulnerability

remote attackers

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.002

Percentile

54.8%

JSON

Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4.

Affected configurations

Nvd

Node

qnapmyqnapcloud_linkRange<2.2.21

AND

qnapqtsMatch4.5.3-

qnapquts_heroMatchh4.5.2-

qnapqutscloudMatchc4.5.4-

VendorProductVersionCPE
qnapmyqnapcloud_link*cpe:2.3:a:qnap:myqnapcloud_link:*:*:*:*:*:*:*:*
qnapqts4.5.3cpe:2.3:o:qnap:qts:4.5.3:-:*:*:*:*:*:*
qnapquts_heroh4.5.2cpe:2.3:o:qnap:quts_hero:h4.5.2:-:*:*:*:*:*:*
qnapqutscloudc4.5.4cpe:2.3:o:qnap:qutscloud:c4.5.4:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	myqnapcloud_link	*	cpe:2.3:a:qnap:myqnapcloud_link::::::::
qnap	qts	4.5.3	cpe:2.3:o:qnap:qts:4.5.3:-::::::
qnap	quts_hero	h4.5.2	cpe:2.3:o:qnap:quts_hero:h4.5.2:-::::::
qnap	qutscloud	c4.5.4	cpe:2.3:o:qnap:qutscloud:c4.5.4:-::::::

CNA Affected

[
  {
    "platforms": [
      "QTS 4.5.3"
    ],
    "product": "myQNAPcloud Link",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.2.21",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QuTS hero h4.5.2"
    ],
    "product": "myQNAPcloud Link",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.2.21",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QuTScloud c4.5.4"
    ],
    "product": "myQNAPcloud Link",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.2.21",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/zh-tw/security-advisory/qsa-21-26

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.002

Percentile

54.8%

JSON

Related for CVE-2021-28815