Lucene search

[email protected]CVE-2023-23372

HistoryDec 08, 2023 - 4:15 p.m.

CVE-2023-23372

2023-12-0816:15:15

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-23372

cross-site scripting

xss

qnap

vulnerability

security

network

injection

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

0.0005 Low

EPSS

Percentile

17.1%

JSON

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2425 build 20230609 and later
QTS 5.1.0.2444 build 20230629 and later
QTS 4.5.4.2467 build 20230718 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTS hero h5.0.1.2515 build 20230907 and later
QuTS hero h4.5.4.2476 build 20230728 and later

Affected configurations

NVD

Node

qnapqtsMatch5.1.0.2348build_20230325

qnapqtsMatch5.1.0.2399build_20230515

qnapqtsMatch5.1.0.2418build_20230603

Node

qnapqtsMatch5.0.1.2034build_20220515

qnapqtsMatch5.0.1.2079build_20220629

qnapqtsMatch5.0.1.2131build_20220820

qnapqtsMatch5.0.1.2137build_20220826

qnapqtsMatch5.0.1.2145build_20220903

qnapqtsMatch5.0.1.2173build_20221001

qnapqtsMatch5.0.1.2194build_20221022

qnapqtsMatch5.0.1.2234build_20221201

qnapqtsMatch5.0.1.2248build_20221215

qnapqtsMatch5.0.1.2277build_20230112

qnapqtsMatch5.0.1.2346build_20230322

qnapqtsMatch5.0.1.2376build_20230421

Node

qnapqtsMatch4.5.4.1715build_20210630

qnapqtsMatch4.5.4.1723build_20210708

qnapqtsMatch4.5.4.1741build_20210726

qnapqtsMatch4.5.4.1787build_20210910

qnapqtsMatch4.5.4.1800build_20210923

qnapqtsMatch4.5.4.1892build_20211223

qnapqtsMatch4.5.4.1931build_20220128

qnapqtsMatch4.5.4.2012build_20220419

qnapqtsMatch4.5.4.2117build_20220802

qnapqtsMatch4.5.4.2280build_20230112

qnapqtsMatch4.5.4.2374build_20230416

Node

qnapquts_heroMatchh5.1.0.2409build_20230525

Node

qnapquts_heroMatchh5.0.1.2045build_20220526

qnapquts_heroMatchh5.0.1.2192build_20221020

qnapquts_heroMatchh5.0.1.2248build_20221215

qnapquts_heroMatchh5.0.1.2269build_20230104

qnapquts_heroMatchh5.0.1.2277build_20230112

qnapquts_heroMatchh5.0.1.2348build_20230324

qnapquts_heroMatchh5.0.1.2376build_20230421

Node

qnapquts_heroMatchh4.5.4.1771build_20210825

qnapquts_heroMatchh4.5.4.1800build_20210923

qnapquts_heroMatchh4.5.4.1813build_20211006

qnapquts_heroMatchh4.5.4.1848build_20211109

qnapquts_heroMatchh4.5.4.1892build_20211223

qnapquts_heroMatchh4.5.4.1951build_20220218

qnapquts_heroMatchh4.5.4.1971build_20220310

qnapquts_heroMatchh4.5.4.1991build_20220330

qnapquts_heroMatchh4.5.4.2052build_20220530

qnapquts_heroMatchh4.5.4.2138build_20220824

qnapquts_heroMatchh4.5.4.2217build_20221111

qnapquts_heroMatchh4.5.4.2272build_20230105

qnapquts_heroMatchh4.5.4.2374build_20230417

CPENameOperatorVersion
qnap:qtsqnap qtseq5.1.0.2348
qnap:qtsqnap qtseq5.1.0.2399
qnap:qtsqnap qtseq5.1.0.2418

CPE	Name	Operator	Version
qnap:qts	qnap qts	eq	5.1.0.2348
qnap:qts	qnap qts	eq	5.1.0.2399
qnap:qts	qnap qts	eq	5.1.0.2418

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.0.1.2425 build 20230609",
        "status": "affected",
        "version": "5.0.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.1.0.2444 build 20230629",
        "status": "affected",
        "version": "5.1.x",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5.4.2467 build 20230718",
        "status": "affected",
        "version": "4.5.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTS hero",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "h5.1.0.2424 build 20230609",
        "status": "affected",
        "version": "h5.1.x",
        "versionType": "custom"
      },
      {
        "lessThan": "h5.0.1.2515 build 20230907",
        "status": "affected",
        "version": "h5.0.x",
        "versionType": "custom"
      },
      {
        "lessThan": "h4.5.4.2476 build 20230728",
        "status": "affected",
        "version": "h4.5.x",
        "versionType": "custom"
      }
    ]
  }
]