Lucene search

QnapCVE-2023-23368

HistoryNov 03, 2023 - 5:15 p.m.

CVE-2023-23368

2023-11-0317:15:08

CWE-78

qnap

web.nvd.nist.gov

107

cve-2023-23368

os command injection

qnap

vulnerability

network security

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

29.6%

JSON

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2376 build 20230421 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2376 build 20230421 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later

Affected configurations

Nvd

Node

qnapqtsMatch5.0.1-

qnapqtsMatch5.0.1.2034build_20220515

qnapqtsMatch5.0.1.2079build_20220629

qnapqtsMatch5.0.1.2131build_20220820

qnapqtsMatch5.0.1.2137build_20220826

qnapqtsMatch5.0.1.2145build_20220903

qnapqtsMatch5.0.1.2173build_20221001

qnapqtsMatch5.0.1.2194build_20221022

qnapqtsMatch5.0.1.2234build_20221201

qnapqtsMatch5.0.1.2248build_20221215

qnapqtsMatch5.0.1.2277build_20230112

qnapqtsMatch5.0.1.2346build_20230322

Node

qnapqtsMatch4.5.4-

qnapqtsMatch4.5.4.1715build_20210630

qnapqtsMatch4.5.4.1723build_20210708

qnapqtsMatch4.5.4.1741build_20210726

qnapqtsMatch4.5.4.1787build_20210910

qnapqtsMatch4.5.4.1800build_20210923

qnapqtsMatch4.5.4.1892build_20211223

qnapqtsMatch4.5.4.1931build_20220128

qnapqtsMatch4.5.4.2012build_20220419

qnapqtsMatch4.5.4.2117build_20220802

qnapqtsMatch4.5.4.2280build_20230112

Node

qnapquts_heroMatchh5.0.1.2045build_20220526

qnapquts_heroMatchh5.0.1.2192build_20221020

qnapquts_heroMatchh5.0.1.2248build_20221215

qnapquts_heroMatchh5.0.1.2269build_20230104

qnapquts_heroMatchh5.0.1.2277build_20230112

qnapquts_heroMatchh5.0.1.2348build_20230324

Node

qnapquts_heroMatchh4.5.4.1771build_20210825

qnapquts_heroMatchh4.5.4.1800build_20210923

qnapquts_heroMatchh4.5.4.1813build_20211006

qnapquts_heroMatchh4.5.4.1848build_20211109

qnapquts_heroMatchh4.5.4.1892build_20211223

qnapquts_heroMatchh4.5.4.1951build_20220218

qnapquts_heroMatchh4.5.4.1971build_20220310

qnapquts_heroMatchh4.5.4.1991build_20220330

qnapquts_heroMatchh4.5.4.2052build_20220530

qnapquts_heroMatchh4.5.4.2138build_20220824

qnapquts_heroMatchh4.5.4.2217build_20221111

qnapquts_heroMatchh4.5.4.2272build_20230105

Node

qnapqutscloudMatchc5.0.1.1949build_20220218

qnapqutscloudMatchc5.0.1.1998build_20220408

qnapqutscloudMatchc5.0.1.2044build_20220524

qnapqutscloudMatchc5.0.1.2148build_20220905

VendorProductVersionCPE
qnapqts5.0.1cpe:2.3:o:qnap:qts:5.0.1:-:*:*:*:*:*:*
qnapqts5.0.1.2034cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:*
qnapqts5.0.1.2079cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:*
qnapqts5.0.1.2131cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:*
qnapqts5.0.1.2137cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:*
qnapqts5.0.1.2145cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:*
qnapqts5.0.1.2173cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:*
qnapqts5.0.1.2194cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:*
qnapqts5.0.1.2234cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:*
qnapqts5.0.1.2248cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	qts	5.0.1	cpe:2.3:o:qnap:qts:5.0.1:-::::::
qnap	qts	5.0.1.2034	cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515::::::
qnap	qts	5.0.1.2079	cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629::::::
qnap	qts	5.0.1.2131	cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820::::::
qnap	qts	5.0.1.2137	cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826::::::
qnap	qts	5.0.1.2145	cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903::::::
qnap	qts	5.0.1.2173	cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001::::::
qnap	qts	5.0.1.2194	cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022::::::
qnap	qts	5.0.1.2234	cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201::::::
qnap	qts	5.0.1.2248	cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215::::::

Rows per page:

1-10 of 451

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.0.1.2376 build 20230421",
        "status": "affected",
        "version": "5.0.x",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5.4.2374 build 20230416",
        "status": "affected",
        "version": "4.5.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTS hero",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "h5.0.1.2376 build 20230421",
        "status": "affected",
        "version": "h5.0.x",
        "versionType": "custom"
      },
      {
        "lessThan": "h4.5.4.2374 build 20230417",
        "status": "affected",
        "version": "h4.5.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTScloud",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "c5.0.1.2374",
        "status": "affected",
        "version": "c5.x.x",
        "versionType": "custom"
      }
    ]
  }
]