Lucene search

QnapVULNRICHMENT:CVE-2023-51366

HistorySep 06, 2024 - 4:26 p.m.

CVE-2023-51366 QTS, QuTS hero

2024-09-0616:26:04

CWE-22

qnap

github.com

path traversal vulnerability

qnap os

sensitive data exposure

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

19.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later

References

www.qnap.com/en/security-advisory/qsa-24-20

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

19.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-51366