Lucene search

QnapCVE-2024-38640

HistorySep 06, 2024 - 5:15 p.m.

CVE-2024-38640

2024-09-0617:15:16

CWE-79

qnap

web.nvd.nist.gov

cross-site scripting

download station

vulnerability

authenticated users

malicious code

network

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/SC:N/VI:L/SI:N/VA:N/SA:N

AI Score

5.4

Confidence

High

EPSS

Percentile

14.7%

JSON

A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Download Station 5.8.6.283 ( 2024/06/21 ) and later

Affected configurations

Nvd

Node

qnapdownload_stationRange5.8.0–5.8.6.283

VendorProductVersionCPE
qnapdownload_station*cpe:2.3:a:qnap:download_station:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	download_station	*	cpe:2.3:a:qnap:download_station::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Download Station",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.8.6.283 ( 2024/06/21 )",
        "status": "affected",
        "version": "5.8.x",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-24-35

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/SC:N/VI:L/SI:N/VA:N/SA:N

AI Score

5.4

Confidence

High

EPSS

Percentile

14.7%

JSON

Related for CVE-2024-38640