CVE-2024-21900

2024-03-0817:15:22

CWE-74

[email protected]

web.nvd.nist.gov

cve-2024-21900

qnap

operating system

injection vulnerability

authenticated users

network commands

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

16.0%

JSON

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later
QuTScloud c5.1.5.2651 and later

Affected configurations

Nvd

Node

qnapqtsRange<5.1.3.2578

qnapqtsMatch5.1.3.2578-

qnapquts_heroRange<h5.1.3.2578

qnapquts_heroMatchh5.1.3.2578-

qnapqutscloudRange<c5.1.5.2651

VendorProductVersionCPE
qnapqts*cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
qnapqts5.1.3.2578cpe:2.3:o:qnap:qts:5.1.3.2578:-:*:*:*:*:*:*
qnapquts_hero*cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
qnapquts_heroh5.1.3.2578cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:-:*:*:*:*:*:*
qnapqutscloud*cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	qts	*	cpe:2.3:o:qnap:qts::::::::
qnap	qts	5.1.3.2578	cpe:2.3:o:qnap:qts:5.1.3.2578:-::::::
qnap	quts_hero	*	cpe:2.3:o:qnap:quts_hero::::::::
qnap	quts_hero	h5.1.3.2578	cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:-::::::
qnap	qutscloud	*	cpe:2.3:o:qnap:qutscloud::::::::