CVE-2023-39301

Description

A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later

Reserved 2023-07-27 | Published 2023-11-03 | Updated 2024-09-05 | Assigner qnap

Problem types

CWE-918

Product status

Default status
unaffected

5.0.x before 5.0.1.2514 build 20230906
affected

5.1.x before 5.1.1.2491 build 20230815
affected

Default status
unaffected

h5.0.x before h5.0.1.2515 build 20230907
affected

h5.1.x before h5.1.1.2488 build 20230812
affected

Default status
unaffected

c5.x.x before c5.1.0.2498
affected

Credits

Aymen BORGI and Ibrahim AYADHI from RandoriSec finder

References

www.qnap.com/en/security-advisory/qsa-23-51

cve.org (CVE-2023-39301)

nvd.nist.gov (CVE-2023-39301)

Download JSON