PT-2023-9452 · Qnap · Qts

Arseniy Sharoglazov · Publicado 2023-08-15 · Atualizado 2024-09-24 · CVE-2023-39300

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.3.6.2805 build 20240619 QTS versions prior to 4.3.4.2814 build 20240618 QTS versions prior to 4.3.3.2784 build 20240619 QTS versions prior to 4.2.6 build 20240618

Description An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. The issue is related to insufficient access control, which could allow a remote attacker to execute arbitrary code in the system.

Recommendations For versions prior to 4.3.6.2805 build 20240619, update to QTS 4.3.6.2805 build 20240619 or later. For versions prior to 4.3.4.2814 build 20240618, update to QTS 4.3.4.2814 build 20240618 or later. For versions prior to 4.3.3.2784 build 20240619, update to QTS 4.3.3.2784 build 20240619 or later. For versions prior to 4.2.6 build 20240618, update to QTS 4.2.6 build 20240618 or later.

Correção

OS Command Injection

Improper Access Control

Enumeração de Fraquezas

CWE-78

CWE-284

Identificadores relacionados

BDU:2024-07678

CVE-2023-39300

Produtos afetados

Qts

Referências · 8

• https://twitter.com/CVEnew/status/1832097909413966233 · Publicação no Twitter
• https://t.me/cvenotify/93771 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39300 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-39300 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1832126535316226216 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2024-07678 · Nota de Segurança
• https://qnap.com/en/security-advisory/qsa-24-26 · Aviso do Fabricante
• https://t.me/cvenotify/95829 · Publicação no Telegram