Lucene search

[email protected]CVE-2024-21899

HistoryMar 08, 2024 - 5:15 p.m.

CVE-2024-21899

2024-03-0817:15:22

CWE-287

[email protected]

web.nvd.nist.gov

cve-2024-21899

improper authentication

qnap

vulnerability

security

network

qts

quts hero

qutscloud

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.2%

JSON

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QTS 4.5.4.2627 build 20231225 and later
QuTS hero h5.1.3.2578 build 20231110 and later
QuTS hero h4.5.4.2626 build 20231225 and later
QuTScloud c5.1.5.2651 and later

Affected configurations

NVD

Node

qnapqtsRange<4.5.4.2627

qnapqtsRange5.1.0–5.1.3.2578

qnapqtsMatch4.5.4.2627-

qnapqtsMatch5.1.3.2578-

qnapquts_heroRange<h4.5.4.2626

qnapquts_heroRangeh5.1.0–h5.1.3.2578

qnapquts_heroMatchh4.5.4.2626-

qnapquts_heroMatchh5.1.3.2578-

qnapqutscloudRange<c5.1.5.2651

CPENameOperatorVersion
qnap:qtsqnap qtslt4.5.4.2627
qnap:qtsqnap qtslt5.1.3.2578
qnap:quts_heroqnap quts herolth4.5.4.2626
qnap:quts_heroqnap quts herolth5.1.3.2578
qnap:qutscloudqnap qutscloudltc5.1.5.2651

CPE	Name	Operator	Version
qnap:qts	qnap qts	lt	4.5.4.2627
qnap:qts	qnap qts	lt	5.1.3.2578
qnap:quts_hero	qnap quts hero	lt	h4.5.4.2626
qnap:quts_hero	qnap quts hero	lt	h5.1.3.2578
qnap:qutscloud	qnap qutscloud	lt	c5.1.5.2651

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.1.3.2578 build 20231110",
        "status": "affected",
        "version": "5.1.x",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5.4.2627 build 20231225",
        "status": "affected",
        "version": "4.5.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTS hero",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "h5.1.3.2578 build 20231110",
        "status": "affected",
        "version": "h5.1.x",
        "versionType": "custom"
      },
      {
        "lessThan": "h4.5.4.2626 build 20231225",
        "status": "affected",
        "version": "h4.5.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTScloud",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "c5.1.5.2651",
        "status": "affected",
        "version": "c5.x.x",
        "versionType": "custom"
      }
    ]
  }
]