9.8Crítica
KEV
Usada en ransomware
CVE-2019-7195QNAP Photo Station Path Traversal Vulnerability
Explotación conocida — QNAP Photo Station Path Traversal Vulnerability
CISA confirmó el 08.06.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 22.06.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-7195
Descripción
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Debilidad (CWE):
CWE-22
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| qnap | photo station | < 6.0.3 | |
| — | QNAP NAS devices running Photo Station | QTS 4.4.1: Photo Station before version 6.0.3, QTS 4.3.4 - QTS 4.4.0: Photo Station before version 5.7.10, QTS 4.3.0 - QTS 4.3.3: Photo Station before version 5.4.9, QTS 4.2.6: Photo Station before version 5.2.11 |
Referencias y parches
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 Vendor Advisory
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7195 US Government Resource
Coincidencias CPE (NVD) (4)
cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 6.0.3cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.7.10cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.4.9cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.2.11