cbcvebase.
CVE-2018-19943
published 2020-10-28

CVE-2018-19943: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the…

PriorityP181medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
KEVITWRansomware
CISA Known Exploited Vulnerabilitydue 2022-06-14
Exploited in the wild
EPSS
17.71%
96.8th percentile
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Affected

13 ranges
VendorProductVersion rangeFixed in
qnapqts< 4.2.64.2.6
qnapqts——
qnapqts>= 4.3.1.0013 < 4.3.3.12524.3.3.1252
qnapqts>= 4.3.4 < 4.3.4.12824.3.4.1282
qnapqts>= 4.3.6 < 4.3.6.12634.3.6.1263
qnapqts>= 4.4.0 < 4.4.1.12614.4.1.1261
qnapqts>= 4.4.2 < 4.4.2.12704.4.2.1270
qnap_systems_incqts>= unspecified < 4.4.2.12704.4.2.1270
qnap_systems_incqts>= unspecified < 4.4.1.12614.4.1.1261
qnap_systems_incqts>= unspecified < 4.3.6.12634.3.6.1263
qnap_systems_incqts>= unspecified < 4.3.4.12824.3.4.1282
qnap_systems_incqts>= unspecified < 4.3.3.12524.3.3.1252
qnap_systems_incqts>= unspecified < 4.2.64.2.6

Detection & IOCsextracted from sources · hover to see the quote

  • →Vulnerability affects QNAP NAS File Station component specifically — monitor for unexpected script injection attempts targeting File Station web interface ↗
  • →Target platform is QNAP Network Attached Storage (NAS) devices running QTS versions prior to the fixed builds — identify exposed QNAP NAS management interfaces on the network ↗
  • ·Fixed in QTS 4.4.2.1270 build 20200410 and later — devices running older builds remain vulnerable ↗
  • ·Fixed in QTS 4.4.1.1261 build 20200330 and later ↗
  • ·Fixed in QTS 4.3.6.1263 build 20200330 and later ↗
  • ·Fixed in QTS 4.3.4.1282 build 20200408 and later ↗
  • ·Fixed in QTS 4.3.3.1252 build 20200409 and later ↗
  • ·Fixed in QTS 4.2.6 build 20200421 and later ↗

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vulncheck8.0HIGH
cisa5.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.