CVE-2020-2497 Cross-site scripting vulnerability in QTS and QuTS hero

🗓️ 10 Dec 2020 03:43:11Reported by qnapType

Cross-site scripting vulnerability in QTS and QuTS hero, allowing remote attackers to inject malicious code in System Connection Logs. Fixed versions are QuTS hero h4.5.1.1472 build 20201031 and later, QTS 4.5.1.1456 build 20201015 and later, QTS 4.4.3.1354 build 20200702 and later, QTS 4.3.6.1333 build 20200608 and later, QTS 4.3.4.1368 build 20200703 and later, QTS 4.3.3.1315 build 20200611 and later, QTS 4.2.6 build 20200611 and late

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2020-2497	10 Dec 202007:33	–	circl
CNNVD	Qnap Systems Cross-Site Scripting Vulnerability in Multiple Products	9 Dec 202000:00	–	cnnvd
CVE	CVE-2020-2497	10 Dec 202003:43	–	cve
EUVD	EUVD-2020-22290	7 Oct 202500:30	–	euvd
NCSC	Vulnerabilities fixed in QNAP QTS	8 Dec 202000:00	–	ncsc
NVD	CVE-2020-2497	10 Dec 202004:15	–	nvd
OpenVAS	QNAP QTS Multiple XSS Vulnerabilities (QSA-20-12)	11 Dec 202000:00	–	openvas
Prion	Cross site scripting	10 Dec 202004:15	–	prion
Tenable Nessus	Qnap QuTS hero Cross-site Scripting (CVE-2020-2497)	16 Oct 202400:00	–	nessus
ThreatPost	QNAP High-Severity Flaws Plague NAS Systems	7 Dec 202016:15	–	threatpost

[
  {
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "<  4.5.1.1456"
      },
      {
        "status": "affected",
        "version": "< 4.4.3.1354"
      },
      {
        "status": "affected",
        "version": "< 4.3.6.1333"
      },
      {
        "status": "affected",
        "version": "< 4.3.4.1368"
      },
      {
        "status": "affected",
        "version": "< 4.3.3.1315"
      },
      {
        "status": "affected",
        "version": "< 4.2.6"
      }
    ]
  },
  {
    "product": "QuTS hero",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "< h4.5.1.1472"
      }
    ]
  }
]

Source	Link
qnap	www.qnap.com/en/security-advisory/qsa-20-12

10 Dec 2020 03:43Current

6.3Medium risk

Vulners AI Score6.3

EPSS0.00973