Lucene search

QnapCVE-2021-34355

HistoryOct 01, 2021 - 3:15 a.m.

CVE-2021-34355

2021-10-0103:15:06

CWE-79

qnap

web.nvd.nist.gov

cve-2021-34355

cross-site scripting

xss

qnap nas

photo station

vulnerability

remote code injection

security patch

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later

Affected configurations

Nvd

Node

qnapphoto_stationRange<5.4.10

qnapphoto_stationRange5.7.0–5.7.13

qnapphoto_stationRange6.0.0–6.0.18

AND

qnapnasMatch-

VendorProductVersionCPE
qnapphoto_station*cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*
qnapnas-cpe:2.3:h:qnap:nas:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	photo_station	*	cpe:2.3:a:qnap:photo_station::::::::
qnap	nas	-	cpe:2.3:h:qnap:nas:-:::::::*

CNA Affected

[
  {
    "product": "Photo Station",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.4.10 ( 2021/08/19 )",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "5.7.13 ( 2021/08/19 )",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "6.0.18 ( 2021/09/01 )",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-21-42

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

Related for CVE-2021-34355