6.1

CVE-2023-23372

QTS, QuTS hero

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2425 build 20230609 and later
QTS 5.1.0.2444 build 20230629 and later
QTS 4.5.4.2467 build 20230718 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTS hero h5.0.1.2515 build 20230907 and later
QuTS hero h4.5.4.2476 build 20230728 and later
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Qnap ≫ Qts Version 5.1.0.2348 Update build_20230325
Qnap ≫ Qts Version 5.1.0.2399 Update build_20230515
Qnap ≫ Qts Version 5.1.0.2418 Update build_20230603
Qnap ≫ Qts Version 5.0.1.2034 Update build_20220515
Qnap ≫ Qts Version 5.0.1.2079 Update build_20220629
Qnap ≫ Qts Version 5.0.1.2131 Update build_20220820
Qnap ≫ Qts Version 5.0.1.2137 Update build_20220826
Qnap ≫ Qts Version 5.0.1.2145 Update build_20220903
Qnap ≫ Qts Version 5.0.1.2173 Update build_20221001
Qnap ≫ Qts Version 5.0.1.2194 Update build_20221022
Qnap ≫ Qts Version 5.0.1.2234 Update build_20221201
Qnap ≫ Qts Version 5.0.1.2248 Update build_20221215
Qnap ≫ Qts Version 5.0.1.2277 Update build_20230112
Qnap ≫ Qts Version 5.0.1.2346 Update build_20230322
Qnap ≫ Qts Version 5.0.1.2376 Update build_20230421
Qnap ≫ Qts Version 4.5.4.1715 Update build_20210630
Qnap ≫ Qts Version 4.5.4.1723 Update build_20210708
Qnap ≫ Qts Version 4.5.4.1741 Update build_20210726
Qnap ≫ Qts Version 4.5.4.1787 Update build_20210910
Qnap ≫ Qts Version 4.5.4.1800 Update build_20210923
Qnap ≫ Qts Version 4.5.4.1892 Update build_20211223
Qnap ≫ Qts Version 4.5.4.1931 Update build_20220128
Qnap ≫ Qts Version 4.5.4.2012 Update build_20220419
Qnap ≫ Qts Version 4.5.4.2117 Update build_20220802
Qnap ≫ Qts Version 4.5.4.2280 Update build_20230112
Qnap ≫ Qts Version 4.5.4.2374 Update build_20230416
Qnap ≫ Quts Hero Version h5.1.0.2409 Update build_20230525
Qnap ≫ Quts Hero Version h5.0.1.2045 Update build_20220526
Qnap ≫ Quts Hero Version h5.0.1.2192 Update build_20221020
Qnap ≫ Quts Hero Version h5.0.1.2248 Update build_20221215
Qnap ≫ Quts Hero Version h5.0.1.2269 Update build_20230104
Qnap ≫ Quts Hero Version h5.0.1.2277 Update build_20230112
Qnap ≫ Quts Hero Version h5.0.1.2348 Update build_20230324
Qnap ≫ Quts Hero Version h5.0.1.2376 Update build_20230421
Qnap ≫ Quts Hero Version h4.5.4.1771 Update build_20210825
Qnap ≫ Quts Hero Version h4.5.4.1800 Update build_20210923
Qnap ≫ Quts Hero Version h4.5.4.1813 Update build_20211006
Qnap ≫ Quts Hero Version h4.5.4.1848 Update build_20211109
Qnap ≫ Quts Hero Version h4.5.4.1892 Update build_20211223
Qnap ≫ Quts Hero Version h4.5.4.1951 Update build_20220218
Qnap ≫ Quts Hero Version h4.5.4.1971 Update build_20220310
Qnap ≫ Quts Hero Version h4.5.4.1991 Update build_20220330
Qnap ≫ Quts Hero Version h4.5.4.2052 Update build_20220530
Qnap ≫ Quts Hero Version h4.5.4.2138 Update build_20220824
Qnap ≫ Quts Hero Version h4.5.4.2217 Update build_20221111
Qnap ≫ Quts Hero Version h4.5.4.2272 Update build_20230105
Qnap ≫ Quts Hero Version h4.5.4.2374 Update build_20230417
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.358
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security@qnapsecurity.com.tw 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.qnap.com/en/security-advisory/qsa-23-40
Vendor Advisory