cbcvebase.
CVE-2018-19953
published 2020-10-28

CVE-2018-19953: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following…

PriorityP181medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
KEVITWRansomware
CISA Known Exploited Vulnerabilitydue 2022-06-14
Exploited in the wild
EPSS
23.89%
97.5th percentile
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Affected

13 ranges
VendorProductVersion rangeFixed in
qnapqts< 4.2.64.2.6
qnapqts
qnapqts>= 4.3.1.0013 < 4.3.3.11614.3.3.1161
qnapqts>= 4.3.4 < 4.3.4.11904.3.4.1190
qnapqts>= 4.3.6 < 4.3.6.12184.3.6.1218
qnapqts>= 4.4.0 < 4.4.1.12014.4.1.1201
qnapqts>= 4.4.2 < 4.4.2.12314.4.2.1231
qnap_systems_incqts>= unspecified < 4.4.2.12314.4.2.1231
qnap_systems_incqts>= unspecified < 4.4.1.12014.4.1.1201
qnap_systems_incqts>= unspecified < 4.3.6.12184.3.6.1218
qnap_systems_incqts>= unspecified < 4.3.4.11904.3.4.1190
qnap_systems_incqts>= unspecified < 4.3.3.11614.3.3.1161
qnap_systems_incqts>= unspecified < 4.2.64.2.6

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability target is QNAP NAS File Station — HTTP requests to File Station endpoints should be inspected for injected script content in parameters
  • ·Fixed in QTS 4.4.2.1231 build 20200302; QTS 4.4.1.1201 build 20200130; QTS 4.3.6.1218 build 20200214; QTS 4.3.4.1190 build 20200107; QTS 4.3.3.1161 build 20200109; QTS 4.2.6 build 20200109 — any QNAP NAS running versions prior to these builds remains vulnerable

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck6.1MEDIUM
cisa6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.