CVE-2021-28806
Medium
Description
A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.
SeverityMedium
CVSS5.7
Exploit probability—
Product
Qnap Quts Hero
PublishedJun 3, 2021
First seenJun 3, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- qnap quts_heroh4.5.2.1638 or later
- qnap qts4.5.3.1652 or later
- qnap qutscloudc4.5.5.1656 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qnap quts_hero | v < h4.5.2.1638 | h4.5.2.1638 |
| qnap qts | v < 4.5.3.1652 | 4.5.3.1652 |
| qnap qutscloud | v < c4.5.5.1656 | c4.5.5.1656 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.