CVE-2023-23372

Опубликовано: 08 дек. 2023

Источник: nvd

CVSS3: 6.5

CVSS3: 6.1

EPSS Низкий

Описание

We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h4.5.4.2476 build 20230728 and later

Ссылки

https://www.qnap.com/en/security-advisory/qsa-23-40
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-40
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2376:build_20230421:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.2374:build_20230416:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2376:build_20230421:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:qnap:quts_hero:h4.5.4.1771:build_20210825:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1800:build_20210923:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1813:build_20211006:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1848:build_20211109:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1892:build_20211223:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1951:build_20220218:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1971:build_20220310:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1991:build_20220330:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2052:build_20220530:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2138:build_20220824:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2217:build_20221111:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2272:build_20230105:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2374:build_20230417:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00225

Низкий

6.5 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-qgpv-vf25-623c

CVSS3: 6.5

github

около 2 лет назад

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h4.5.4.2476 build 20230728 and later

BDU:2024-03600

CVSS3: 6.1

fstec

около 2 лет назад

Уязвимость операционной системы QTS сетевых хранилищ QNAP, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)

EPSS

Процентиль: 45%

0.00225

Низкий

6.5 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79