PT-2013-2130 · Qnap · Qnap Viostor Nvr

David Elze + 1 · Publicado 2013-06-07 · Atualizado 2013-06-10 · CVE-2013-0144

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QNAP VioStor NVR devices with firmware 4.0.3

Description A cross-site request forgery (CSRF) issue affects the cgi-bin/create user.cgi endpoint, allowing remote attackers to hijack administrator authentication for creating administrative accounts via a NEW USER action.

Recommendations For QNAP VioStor NVR devices with firmware 4.0.3, consider disabling access to the cgi-bin/create user.cgi endpoint until a patch is available to prevent exploitation of the CSRF issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-0144

Produtos afetados

Qnap Viostor Nvr

Referências · 2

• http://kb.cert.org/vuls/id/927644 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-0144 · Nota de Segurança