PT-2022-3427 · Qnap · Qts+2

Published 2022-05-05 · Updated 2023-11-14 · CVE-2021-44053

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.5.4.1991 build 20220329 QTS versions prior to 5.0.0.1986 build 20220324 QuTS hero versions prior to h4.5.4.1971 build 20220310 QuTS hero versions prior to h5.0.0.1986 build 20220324 QuTScloud versions prior to c5.0.1.1949

Description A cross-site scripting (XSS) issue affects QNAP devices running QTS, QuTS hero, and QuTScloud, due to inadequate protection of the web page structure. This allows remote attackers to inject malicious code, potentially impacting the confidentiality and integrity of information.

Recommendations For QTS versions prior to 4.5.4.1991 build 20220329, update to QTS 4.5.4.1991 build 20220329 or later. For QTS versions prior to 5.0.0.1986 build 20220324, update to QTS 5.0.0.1986 build 20220324 or later. For QuTS hero versions prior to h4.5.4.1971 build 20220310, update to QuTS hero h4.5.4.1971 build 20220310 or later. For QuTS hero versions prior to h5.0.0.1986 build 20220324, update to QuTS hero h5.0.0.1986 build 20220324 or later. For QuTScloud versions prior to c5.0.1.1949, update to QuTScloud c5.0.1.1949 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04205

CVE-2021-44053

Affected Products

Qts

Quts Hero

Qutscloud

References · 5

• https://bdu.fstec.ru/vul/2022-04205 · Security Note
• https://qnap.com/en/security-advisory/qsa-22-16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44053 · Security Note
• https://t.me/cibsecurity/42014 · Telegram Post