CVE-2024-21900

2024-03-0817:15:22

CWE-74

[email protected]

web.nvd.nist.gov

cve-2024-21900

qnap

qts

quts hero

qutscloud

injection vulnerability

network security

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.2%

JSON

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later
QuTScloud c5.1.5.2651 and later

Affected configurations

NVD

Node

qnapqtsRange<5.1.3.2578

qnapqtsMatch5.1.3.2578-

qnapquts_heroRange<h5.1.3.2578

qnapquts_heroMatchh5.1.3.2578-

qnapqutscloudRange<c5.1.5.2651

CPENameOperatorVersion
qnap:qtsqnap qtslt5.1.3.2578
qnap:quts_heroqnap quts herolth5.1.3.2578
qnap:qutscloudqnap qutscloudltc5.1.5.2651

CPE	Name	Operator	Version
qnap:qts	qnap qts	lt	5.1.3.2578
qnap:quts_hero	qnap quts hero	lt	h5.1.3.2578
qnap:qutscloud	qnap qutscloud	lt	c5.1.5.2651

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.1.3.2578 build 20231110",
        "status": "affected",
        "version": "5.1.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTS hero",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "h5.1.3.2578 build 20231110",
        "status": "affected",
        "version": "h5.1.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTScloud",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "c5.1.5.2651",
        "status": "affected",
        "version": "c5.x.x",
        "versionType": "custom"
      }
    ]
  }
]