Overview
- Description
- A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later
- Source
- security@qnapsecurity.com.tw
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 4.3
- Impact score
- 1.4
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
Weaknesses
- security@qnapsecurity.com.tw
- CWE-918
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE4E63EE-19E3-4A18-B22C-8E5A178643E6",
"versionEndExcluding": "5.1.1.2491"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B2C011A-E432-4F18-8661-E51F3A1E969A",
"versionEndExcluding": "5.0.1.2514"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC1722B6-35FA-4544-B22F-257DE9A7B9CF",
"versionEndExcluding": "h5.1.1.2488"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F2CBD911-61F2-4248-9918-67A34E049686",
"versionEndExcluding": "h5.0.1.2515"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CDA1932-DFFE-40B4-B8A8-E84914C99601",
"versionEndExcluding": "c5.1.0.2498"
}
],
"operator": "OR"
}
]
}
]