PT-2020-5342 · Qnap · Qes

Published 2020-12-23 · Updated 2020-12-28 · CVE-2020-2505

Positive Technologies (AI Summary)

CVSS v3.1

2.3

Low

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions QES versions prior to 2.1.1 Build 20201006

Description The issue is related to weaknesses in the error reporting mechanism of the QES operating system. If exploited, it could allow attackers to gain sensitive information via the generation of error messages.

Recommendations For versions prior to 2.1.1 Build 20201006, update to QES 2.1.1 Build 20201006 or later to resolve the issue. As a temporary workaround, consider restricting access to error messages to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-209

CWE-755

Related Identifiers

BDU:2021-00171

CVE-2020-2505

Affected Products

Qes

References · 7

• https://bdu.fstec.ru/vul/2021-00171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-2505 · Security Note
• https://qnap.com/zh-tw/security-advisory/qsa-20-17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2505 · Vendor Advisory
• https://t.me/cvenotify/7682 · Telegram Post
• https://securitylab.ru/news/515084.php · Note
• https://t.me/cibsecurity/21264 · Telegram Post