CVE-2023-39301 | THREATINT

Assigner	qnap
Reserved	2023-07-27
Published	2023-11-03
Updated	2024-09-05

Description

A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later

MEDIUM: 4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-918

Product status

Default status

0x4002c8d360

5.0.x before 5.0.1.2514 build 20230906

affected

5.1.x before 5.1.1.2491 build 20230815

affected

Default status

0x4002c8d3d0

h5.0.x before h5.0.1.2515 build 20230907

affected

h5.1.x before h5.1.1.2488 build 20230812

affected

Default status

0x4002c8d440

c5.x.x before c5.1.0.2498

affected

Credits

Aymen BORGI and Ibrahim AYADHI from RandoriSec 0x4002c8d490

References

https://www.qnap.com/en/security-advisory/qsa-23-51

cve.org CVE-2023-39301

nvd.nist.gov CVE-2023-39301

Download JSON