CVE-2021-34352

Опубликовано: 01 окт. 2021

Источник: nvd

CVSS3: 7.2

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later

Ссылки

https://www.qnap.com/en/security-advisory/qsa-21-38
Patch
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-21-38
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:qnap:qvr:*:*:*:*:*:*:*:*

Версия до 5.1.5 (исключая)

EPSS

Процентиль: 88%

0.04181

Низкий

7.2 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-78

CWE-77

Связанные уязвимости

GHSA-w526-38c2-jc6q

github

больше 3 лет назад

EPSS

Процентиль: 88%

0.04181

Низкий

7.2 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-78

CWE-77