PT-2020-8659 · Qnap Systems · Music Station

Published 2020-11-02 · Updated 2022-11-16 · CVE-2018-19951

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Music Station versions prior to 5.1.13 QNAP Systems Inc. Music Station versions prior to 5.2.9 QNAP Systems Inc. Music Station versions prior to 5.3.11

Description: This issue is a cross-site scripting vulnerability that could allow remote attackers to inject malicious code if exploited.

Recommendations: For versions prior to 5.1.13, update to version 5.1.13 or later. For versions prior to 5.2.9, update to version 5.2.9 or later. For versions prior to 5.3.11, update to version 5.3.11 or later.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2018-19951

Affected Products

Music Station

References · 4

• https://qnap.com/en/security-advisory/qsa-20-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19951 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19951 · Vendor Advisory
• https://t.me/cibsecurity/15776 · Telegram Post