Lucene search

QnapCVE-2017-13073

HistoryApr 23, 2018 - 2:29 p.m.

CVE-2017-13073

2018-04-2314:29:01

CWE-79

qnap

web.nvd.nist.gov

cve-2017-13073

nvd

security

vulnerability

qnap nas

photo station

xss

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

45.6%

JSON

Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.

Affected configurations

Nvd

Node

qnapphoto_stationRange5.2.0–5.2.7

qnapphoto_stationRange5.4.0–5.4.3

VendorProductVersionCPE
qnapphoto_station*cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	photo_station	*	cpe:2.3:a:qnap:photo_station::::::::

CNA Affected

[
  {
    "product": "Photo Station",
    "vendor": "QNAP",
    "versions": [
      {
        "status": "affected",
        "version": "versions 5.4.3 and earlier for QTS 4.3.x"
      },
      {
        "status": "affected",
        "version": "versions 5.2.7 and earlier for QTS 4.2.x"
      }
    ]
  }
]

References

www.qnap.com/zh-tw/security-advisory/nas-201804-23

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

45.6%

JSON

Related for CVE-2017-13073