PT-2023-24108 · Qnap · Qutscloud+2

Bingwei Peng + 1 · Publicado 2023-10-13 · Atualizado 2023-10-19 · CVE-2023-32970

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions QuTS hero versions prior to h5.0.1.2515 build 20230907 QuTS hero versions prior to h5.1.0.2453 build 20230708 QuTS hero versions prior to h4.5.4.2476 build 20230728 QuTScloud versions prior to c5.1.0.2498 QTS versions prior to 5.1.0.2444 build 20230629 QTS versions prior to 4.5.4.2467 build 20230718

Description A NULL pointer dereference issue has been reported, which could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.

Recommendations For QuTS hero versions prior to h5.0.1.2515 build 20230907, update to QuTS hero h5.0.1.2515 build 20230907 or later. For QuTS hero versions prior to h5.1.0.2453 build 20230708, update to QuTS hero h5.1.0.2453 build 20230708 or later. For QuTS hero versions prior to h4.5.4.2476 build 20230728, update to QuTS hero h4.5.4.2476 build 20230728 or later. For QuTScloud versions prior to c5.1.0.2498, update to QuTScloud c5.1.0.2498 or later. For QTS versions prior to 5.1.0.2444 build 20230629, update to QTS 5.1.0.2444 build 20230629 or later. For QTS versions prior to 4.5.4.2467 build 20230718, update to QTS 4.5.4.2467 build 20230718 or later.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2023-32970

Produtos afetados

Qts

Quts Hero

Qutscloud

Referências · 3

• https://qnap.com/en/security-advisory/qsa-23-41 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-32970 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32970 · Nota de Segurança