This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] QNAP fixes multiple vulnerabilities in its products
QNAP fixes several vulnerabilities in its products. The most severe of them can be found below. Products and their fixed versions: Video Station - 5.8.2 [1] Download Station - 5.8.6.283 (2024/06/21) [2] QuMagie - 2.3.1 [3] QuLog Center - 1.8.0.872 (2024/06/17), 1.7.0.827 (2024/06/17) [4] Helpdesk - 3.3.1 [5] Music Station - 5.4.0 [6] QVR Smart Client - 2.4.0.0570 [7] Notes Station 3 - 3.9.6 [8] QTS - 5.1.8.2823 build 20240712, 5.2.0.2782 build 20240601 [9] [10] [11] QuTS hero - h5.1.8.2823 build 20240712, h5.2.0.2782 build 20240601[9] [10] [11]
Allows an authenticated remote attacker to execute arbitrary commands in the operating system through input in the Video Station application [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
More information:
- CVE-2023-47563 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an authenticated remote attacker to inject malicious code in Video Station [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2023-50360 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an authenticated remote attacker to inject malicious code in Download Station [2].
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-38640 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an authenticated local attacker to compromise the security of the system in QuMagie [3].
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-38642 at cve.org, NVD
- CWE-295: Improper Certificate Validation at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an unauthenticated remote attacker to inject malicious code in QuLog Center [4].
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H
More information:
- CVE-2024-32762 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an authenticated remote attacker to inject malicious code in Helpdesk [5].
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
More information:
- CVE-2024-27125 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an unauthenticated remote attacker to compromise the security of the system in Music Station [6].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
More information:
- CVE-2023-45038 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an authenticated local attacker to execute unauthorized code or commands in QVR Smart Client [7].
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2022-27592 at cve.org, NVD
- CWE-428: Unquoted Search Path or Element at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an authenticated remote attacker to inject malicious code in Notes Station 3 [8].
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
More information:
- CVE-2024-27122 at cve.org, NVD
- CVE-2024-27126 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Allows an authenticated local attacker to inject malicious commands in QTS and QuTS hero [9].
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-38641 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
An unauthenticated remote attacker can inject malicious commands in QTS and QuTS hero [10].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2023-34974 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
An authenticated local attacker can access data or perform actions without proper authorization in QTS and QuTS hero [11].
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2023-39298 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 7. 9. 2024.
Links
- [1] https://www.qnap.com/en/security-advisory/qsa-24-24
- [2] https://www.qnap.com/en/security-advisory/qsa-24-35
- [3] https://www.qnap.com/en/security-advisory/qsa-24-34
- [4] https://www.qnap.com/en/security-advisory/qsa-24-30
- [5] https://www.qnap.com/en/security-advisory/qsa-24-29
- [6] https://www.qnap.com/en/security-advisory/qsa-24-25
- [7] https://www.qnap.com/en/security-advisory/qsa-24-22
- [8] https://www.qnap.com/en/security-advisory/qsa-24-21
- [9] https://www.qnap.com/en/security-advisory/qsa-24-33
- [10] https://www.qnap.com/en/security-advisory/qsa-24-32
- [11] https://www.qnap.com/en/security-advisory/qsa-24-28
By CESNET, z.s.p.o. Michaela Jarošová on 19. 9. 2024.