PT-2024-12372 · Qnap · Qts+2

Shahnawaz Shaikh · Published 2024-03-08 · Updated 2025-12-05 · CVE-2023-32969

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions QuTScloud versions prior to 5.1.5.2651 QTS versions prior to 5.1.4.2596 build 20231128 QuTS hero versions prior to 5.1.4.2596 build 20231128

Description A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network.

Recommendations For QuTScloud versions prior to 5.1.5.2651, update to version 5.1.5.2651 or later. For QTS versions prior to 5.1.4.2596 build 20231128, update to version 5.1.4.2596 build 20231128 or later. For QuTS hero versions prior to 5.1.4.2596 build 20231128, update to version 5.1.4.2596 build 20231128 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-32969

Affected Products

Qts

Quts Hero

Qutscloud

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-32969 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32969 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-24-11 · Vendor Advisory
• https://twitter.com/CVEnew/status/1766141278834630853 · Twitter Post
• https://t.me/cveNotify/144952 · Telegram Post
• https://t.me/cvenotify/73385 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1766206295923642799 · Twitter Post
• https://t.me/cvenotify/73408 · Telegram Post