Lucene search

QnapCVELIST:CVE-2024-27125

HistorySep 06, 2024 - 4:27 p.m.

CVE-2024-27125 Helpdesk

2024-09-0616:27:17

CWE-79

qnap

www.cve.org

cross-site scripting

helpdesk

authenticated administrators

malicious code

network

fixed vulnerability

version 3.3.1.

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

EPSS

Percentile

14.7%

JSON

A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Helpdesk 3.3.1 and later

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Helpdesk",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "3.3.1",
        "status": "affected",
        "version": "3.3.x",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-24-29