CVE-2021-38693
Description
A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
How to fix
- qnap quts_heroh5.0.0.1949 or later
- qnap qts4.5.4.1991, 5.0.0.1986 or later
- qnap qutscloudc5.0.1.1949 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qnap quts_hero | h5.0.0.1772 ≤ v < h5.0.0.1949 | h5.0.0.1949 |
| qnap qts | v < 4.5.4.1991, 5.0.0.1716 ≤ v < 5.0.0.1986 | 4.5.4.1991, 5.0.0.1986 |
| qnap qutscloud | v < c5.0.1.1949 | c5.0.1.1949 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.