IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.0High KEV Used in ransomware

CVE-2018-19943QNAP NAS File Station Cross-Site Scripting Vulnerability

QNAP Systems Inc. QTS Published: (6 years ago)

Known exploited — QNAP NAS File Station Cross-Site Scripting Vulnerability

CISA confirmed this vulnerability is used in real attacks on 24.05.2022. Remediation deadline for US federal agencies: 14.06.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-19943

Description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Weakness (CWE): CWE-79CWE-80

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
QNAP Systems Inc. QTS unspecified – < 4.4.2.1270

References and patches

CPE matches (NVD) (16)
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* < 4.2.6
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* ≥ 4.3.1.0013 < 4.3.3.1252
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* ≥ 4.3.4 < 4.3.4.1282
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* ≥ 4.3.6 < 4.3.6.1263
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* ≥ 4.4.0 < 4.4.1.1261
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* ≥ 4.4.2 < 4.4.2.1270
  • cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*