Eduard Agavriloae

**Name of the Vulnerable Software and Affected Versions** actiNAS-SL-2U-8 version 3.2.03-SP1 **Description** The issue concerns multiple reflected cross-site scripting (XSS) vulnerabilities in the nasSvr.php file. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML, potentially leading to various malicious actions. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For version 3.2.03-SP1, consider disabling access to the nasSvr.php file as a temporary workaround until a patch is available. Restricting input to prevent arbitrary web script or HTML injection is also recommended. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** actidata actiNAS SL 2U-8 RDX version 3.2.03-SP1 **Description** The issue is related to improper access control on the nasSvr.php file, allowing remote attackers to read and modify different types of data without authentication. **Recommendations** For version 3.2.03-SP1, consider restricting access to the nasSvr.php file until a patch is available. As a temporary workaround, avoid using the nasSvr.php file for sensitive data operations until the issue is resolved. Restrict access to the vulnerable nasSvr.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** actidata actiNAS SL 2U-8 RDX version 3.2.03-SP1 **Description** A Site-wide directory listing issue in the `/fm` endpoint allows remote attackers to list the files hosted by the web application. This issue enables attackers to gain unauthorized access to sensitive information. **Recommendations** For actidata actiNAS SL 2U-8 RDX version 3.2.03-SP1, consider restricting access to the `/fm` endpoint until a patch is available. As a temporary workaround, disabling directory listing for the `/fm` endpoint can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.