PT-2020-8660 · Qnap Systems · Music Station

Published 2020-11-02 · Updated 2020-11-04 · CVE-2018-19952

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Music Station versions prior to 5.1.13 QNAP Systems Inc. Music Station versions prior to 5.2.9 QNAP Systems Inc. Music Station versions prior to 5.3.11

Description: This issue could allow remote attackers to obtain application information if exploited.

Recommendations: For versions prior to 5.1.13, update to version 5.1.13 or later. For versions prior to 5.2.9, update to version 5.2.9 or later. For versions prior to 5.3.11, update to version 5.3.11 or later.

Fix

SQL injection

XSS

RCE

Weakness Enumeration

CWE-89

CWE-80

CWE-943

CWE-20

Related Identifiers

CVE-2018-19952

Affected Products

Music Station

References · 3

• https://qnap.com/en/security-advisory/qsa-20-10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-19952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19952 · Security Note