PT-2020-5343 · Qnap · Qnap Qes

Published 2020-12-23 · Updated 2020-12-28 · CVE-2020-2503

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP QES versions prior to 2.1.1 Build 20201006

Description This issue is related to a stored cross-site scripting vulnerability that could allow remote attackers to inject malicious code in File Station. The vulnerability is associated with the lack of protection measures for the web page structure, which could enable a remote attacker to perform a cross-site scripting attack.

Recommendations For QNAP QES versions prior to 2.1.1 Build 20201006, update to QES 2.1.1 Build 20201006 or later to resolve the issue. As a temporary workaround, consider restricting access to the File Station to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

CWE-749

Related Identifiers

BDU:2021-00172

CVE-2020-2503

Affected Products

Qnap Qes

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-2503 · Security Note
• https://bdu.fstec.ru/vul/2021-00172 · Security Note
• https://qnap.com/zh-tw/security-advisory/qsa-20-17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2503 · Vendor Advisory
• https://t.me/cvenotify/7681 · Telegram Post
• https://t.me/cibsecurity/21261 · Telegram Post
• https://t.me/cvenotify/7820 · Telegram Post
• https://securitylab.ru/news/515084.php · Note