CVE-2023-23355
Assigner: qnap
Published: 2023-03-29T04:02:59.944Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: QTS
vendor: QNAP Systems Inc.
versions: lessThan: 5.0.1.2346 build 20230322
status: affected
version: 5.0.*
versionType: custom
lessThan: 4.5.4.2374 build 20230416
status: affected
version: 4.5.*
versionType: custom
defaultStatus: unaffected
product: QuTS hero
vendor: QNAP Systems Inc.
versions: lessThan: h5.0.1.2348 build 20230324
status: affected
version: h5.0.*
versionType: custom
lessThan: h4.5.4.2374 build 20230417
status: affected
version: h4.5.*
versionType: custom
defaultStatus: unaffected
product: QuTScloud
vendor: QNAP Systems Inc.
versions: lessThan: c5.0.1.2374
status: affected
version: c5.0.1
versionType: custom
defaultStatus: unaffected
product: QES
vendor: QNAP Systems Inc.
versions: status: unaffected
version: 2.2.0
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: YC of the M1QLin security team
descriptions: supportingMedia: base64: no
type: text/html
value: An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors.<br>QES is not affected.<br><br>We have already fixed the vulnerability in the following versions:<br>QTS 5.0.1.2346 build 20230322 and later<br>QTS 4.5.4.2374 build 20230416 and later<br>QuTS hero h5.0.1.2348 build 20230324 and later<br>QuTS hero h4.5.4.2374 build 20230417 and later<br>QuTScloud c5.0.1.2374 and later<br>
value: An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors.
QES is not affected.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2346 build 20230322 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2348 build 20230324 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later

impacts: capecId: CAPEC-88
descriptions: value: CAPEC-88
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-77
description: CWE-77
type: CWE
cweId: CWE-78
description: CWE-78
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: We have already fixed the vulnerability in the following versions:<br>QTS 5.0.1.2346 build 20230322 and later<br>QTS 4.5.4.2374 build 20230416 and later<br>QuTS hero h5.0.1.2348 build 20230324 and later<br>QuTS hero h4.5.4.2374 build 20230417 and later<br>QuTScloud c5.0.1.2374 and later<br>
value: We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2346 build 20230322 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2348 build 20230324 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later

source: advisory: QSA-23-10
discovery: EXTERNAL
title: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR
x_generator: engine: Vulnogram 0.1.0-dev