MEDIUM

CVE-2018-19953

Qnap Qts 2020-10-28 CVSS v3.1

CVSS

6.1

KEV

Description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Summary dbcve.org

Cross-site scripting (XSS) vulnerability in QNAP QTS firmware that allows remote attackers to inject malicious scripts through unspecified vectors. The vulnerability is exploitable without authentication and could lead to session hijacking or malicious content injection against users of the QTS web interface.

Mitigation

Update QNAP QTS to one of the fixed versions (QTS 4.4.2.1231 build 20200302, 4.4.1.1201 build 20200130, 4.3.6.1218 build 20200214, 4.3.4.1190 build 20200107, 4.3.3.1161 build 20200109, or 4.2.6 build 20200109) as specified in the vendor advisory.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

CWE-80

EPSS Score

28.77%

Probability of exploitation in next 30 days

98.1th percentile

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-01 Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19953 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE