PT-2022-10343 · Qnap · Qutscloud+3

Tony Martin · Published 2022-05-26 · Updated 2022-06-07 · CVE-2021-34360

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP Proxy Server versions prior to 1.4.2 QNAP Proxy Server versions prior to 1.4.3 in QuTS hero h5.0.0 QNAP Proxy Server versions prior to 1.4.2 in QuTScloud c4.5.6

Description A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP devices running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code.

Recommendations For QTS 4.5.x, update Proxy Server to version 1.4.2 or later. For QuTS hero h5.0.0, update Proxy Server to version 1.4.3 or later. For QuTScloud c4.5.6, update Proxy Server to version 1.4.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-34360

Affected Products

Qnap Proxy Server

Qts

Quts Hero

Qutscloud

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-34360 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34360 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-22-18 · Vendor Advisory
• https://t.me/cibsecurity/43393 · Telegram Post