PT-2024-2013 · Qnap · Qts+1

Published 2024-03-08 · Updated 2024-05-19 · CVE-2024-21901

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions myQNAPcloud versions prior to 1.0.52 QTS versions prior to 4.5.4.2627 build 20231225

Description A SQL injection vulnerability has been reported, which could allow authenticated administrators to inject malicious code via a network. The vulnerability is related to the lack of protection against SQL query structure attacks. If exploited, it may allow a remote attacker to execute arbitrary code.

Recommendations For myQNAPcloud versions prior to 1.0.52, update to version 1.0.52 or later. For QTS versions prior to 4.5.4.2627 build 20231225, update to version 4.5.4.2627 build 20231225 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-01874

CVE-2024-21901

ZDI-24-471

Affected Products

Qts

Myqnapcloud

References · 15

• https://qnap.com/en/security-advisory/qsa-24-09 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-471 · Security Note
• https://bdu.fstec.ru/vul/2024-01874 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21901 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21901 · Vendor Advisory
• https://t.me/true_secator/5506 · Telegram Post
• https://twitter.com/fletch_ai/status/1766631821234602211 · Twitter Post
• https://twitter.com/DailyDarkWeb/status/1767581325584982294 · Twitter Post
• https://twitter.com/CVEnew/status/1766141274778669142 · Twitter Post
• https://twitter.com/SRA_ThreatWatch/status/1767171669452292268 · Twitter Post
• https://twitter.com/qualys/status/1767572709905420657 · Twitter Post
• https://github.com/advisories/GHSA-8vmv-4hfm-2fv8 · Note
• https://twitter.com/VulmonFeeds/status/1766186096428216437 · Twitter Post
• https://t.me/cvenotify/73390 · Telegram Post
• https://t.me/cvenotify/73722 · Telegram Post