CVE-2021-34360 — Cross-Site Request Forgery in Systems INC Proxy Server

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
8.8HIGHNVD
CNA5.3
EPSS
0.1%
top 74.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Qnap Systems INC Proxy ServerQnap NAS Proxy Server
Timeline
PublishedMay 26
Latest updateMay 27

Description

A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later QuTScloud c4.5.6: Proxy Server 1.4.2 ( 2021/12/30 ) and later

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDqnap/nas_proxy_server1.4.0 — 1.4.2+1
▶CVEListV5qnap_systems_inc/proxy_serverunspecified — 1.4.2 ( 2021/12/30 )+1

🔴Vulnerability Details

2
GHSA
GHSA-fx2r-gh7f-x6hf: A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server↗2022-05-27
▶
CVEList
CSRF Bypass in Proxy Server↗2022-05-26
▶