Lucene search

QnapCVELIST:CVE-2021-38677

HistoryJan 14, 2022 - 1:00 a.m.

CVE-2021-38677 Reflected XSS Vulnerability in QcalAgent

2022-01-1401:00:16

CWE-79

qnap

www.cve.org

cve-2021-38677

reflected xss

qnap device

qcalagent 1.1.7

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

45.3%

JSON

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later

CNA Affected

[
  {
    "product": "QcalAgent",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "1.1.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-21-60

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

45.3%

JSON

Related for CVELIST:CVE-2021-38677