CVE-2018-19943
HighActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
SeverityHigh
CVSS8.0
Exploit probability—
Product
QNAP Network Attached Storage (NAS)
PublishedOct 28, 2020
First seenOct 28, 2020
Added to KEVMay 24, 2022
Weakness typeCWE-79Cross-site scripting (XSS)CWE-80CWE-80
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Jun 14, 2022Update
- qnap qts4.2.6, 4.3.3.1252, 4.3.4.1282, 4.3.6.1263, 4.4.1.1261, 4.4.2.1270 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qnap qts | v < 4.2.6, 4.3.1.0013 ≤ v < 4.3.3.1252, 4.3.4 ≤ v < 4.3.4.1282, 4.3.6 ≤ v < 4.3.6.1263, 4.4.0 ≤ v < 4.4.1.1261, 4.4.2 ≤ v < 4.4.2.1270, 4.2.6 | 4.2.6, 4.3.3.1252, 4.3.4.1282, 4.3.6.1263, 4.4.1.1261, 4.4.2.1270 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.