Lucene search

QnapVULNRICHMENT:CVE-2023-32976

HistoryOct 13, 2023 - 7:16 p.m.

CVE-2023-32976 Container Station

2023-10-1319:16:54

CWE-78

qnap

github.com

cve-2023-32976

container station

os command injection

CVSS3

6.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following version:
Container Station 2.6.7.44 and later

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:qnap:container_station:*:*:*:*:*:*:*:*"
    ],
    "vendor": "qnap",
    "product": "container_station",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.x",
        "lessThan": "2.6.7.44",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

www.qnap.com/en/security-advisory/qsa-23-44

CVSS3

6.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2023-32976