PT-2022-10747 · Qnap · Qutscloud+2

Tony Martin · Published 2022-01-07 · Updated 2022-01-14 · CVE-2021-38674

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.5.4.1787 build 20210910 QuTS hero versions prior to h4.5.4.1771 build 20210825 QuTScloud versions prior to c4.5.7.1864

Description A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero, and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code.

Recommendations For QTS versions prior to 4.5.4.1787 build 20210910, update to version 4.5.4.1787 build 20210910 or later. For QuTS hero versions prior to h4.5.4.1771 build 20210825, update to version h4.5.4.1771 build 20210825 or later. For QuTScloud versions prior to c4.5.7.1864, update to version c4.5.7.1864 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-38674

Affected Products

Qts

Quts Hero

Qutscloud

References · 4

• https://osv.dev/vulnerability/CVE-2021-38674 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-21-63 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38674 · Security Note
• https://t.me/cvenotify/25082 · Telegram Post