CVE-2023-23363
Assigner: qnap
Published: 2023-09-22T03:50:42.730Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: QTS
vendor: QNAP Systems Inc.
versions: lessThan: 4.3.6.2441 build 20230621
status: affected
version: 4.3.*
versionType: custom
lessThan: 4.3.3.2420 build 20230621
status: affected
version: 4.3.*
versionType: custom
lessThan: 4.2.6 build 20230621
status: affected
version: 4.2.*
versionType: custom
lessThan: 4.3.4.2451 build 20230621
status: affected
version: 4.3.*
versionType: custom
status: unaffected
version: 4.5.*
status: unaffected
version: 5.*.*
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: H4lo
descriptions: supportingMedia: base64: no
type: text/html
value: A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.<br><br>We have already fixed the vulnerability in the following versions:<br>QTS 4.3.6.2441 build 20230621 and later<br>QTS 4.3.3.2420 build 20230621 and later<br>QTS 4.2.6 build 20230621 and later<br>QTS 4.3.4.2451 build 20230621 and later<br>
value: A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.

We have already fixed the vulnerability in the following versions:
QTS 4.3.6.2441 build 20230621 and later
QTS 4.3.3.2420 build 20230621 and later
QTS 4.2.6 build 20230621 and later
QTS 4.3.4.2451 build 20230621 and later

impacts: capecId: CAPEC-100
descriptions: value: CAPEC-100
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-120
description: CWE-120
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: We have already fixed the vulnerability in the following versions:<br>QTS 4.3.6.2441 build 20230621 and later<br>QTS 4.3.3.2420 build 20230621 and later<br>QTS 4.2.6 build 20230621 and later<br>QTS 4.3.4.2451 build 20230621 and later<br>
value: We have already fixed the vulnerability in the following versions:
QTS 4.3.6.2441 build 20230621 and later
QTS 4.3.3.2420 build 20230621 and later
QTS 4.2.6 build 20230621 and later
QTS 4.3.4.2451 build 20230621 and later

source: advisory: QSA-23-25
discovery: EXTERNAL
title: QTS
x_generator: engine: Vulnogram 0.1.0-dev