Lucene search

QnapCVE-2023-41290

HistoryApr 26, 2024 - 3:15 p.m.

CVE-2023-41290

2024-04-2615:15:46

CWE-22

qnap

web.nvd.nist.gov

path traversal

qufirewall

vulnerability

fixed

version 2.4.1

nvd

CVSS3

4.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

Percentile

10.5%

JSON

A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following version:
QuFirewall 2.4.1 ( 2024/02/01 ) and later

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "QuFirewall",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.4.1 ( 2024/02/01 )",
        "status": "affected",
        "version": "2.4.x",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-24-17

CVSS3

4.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

Percentile

10.5%

JSON

Related for CVE-2023-41290