CVE-2021-44053: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability…

PriorityP426medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.71%

48.8th percentile

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later

Affected

14 ranges

Vendor	Product	Version range	Fixed in
qnap	qts	—	—
qnap	qts	>= 4.3.3.0174 < 4.3.3.1945	4.3.3.1945
qnap	qts	>= 4.3.4.0899 < 4.3.4.1976	4.3.4.1976
qnap	qts	>= 4.3.6.0895 < 4.3.6.1965	4.3.6.1965
qnap	qts	>= 4.4.0.0883 < 4.5.4.1991	4.5.4.1991
qnap	qts	>= 5.0.0.1716 < 5.0.0.1986	5.0.0.1986
qnap	quts_hero	< h4.5.4.1771	h4.5.4.1771
qnap	quts_hero	>= h5.0.0.1772 < h5.0.0.1986	h5.0.0.1986
qnap	qutscloud	< c5.0.1.1998	c5.0.1.1998
qnap_systems_inc	qts	>= unspecified < 4.5.4.1991 build 20220329	4.5.4.1991 build 20220329
qnap_systems_inc	qts	>= unspecified < 5.0.0.1986 build 20220324	5.0.0.1986 build 20220324
qnap_systems_inc	quts_hero	>= unspecified < h5.0.0.1986 build 20220324	h5.0.0.1986 build 20220324
qnap_systems_inc	quts_hero	>= unspecified < h4.5.4.1971 build 20220310	h4.5.4.1971 build 20220310
qnap_systems_inc	qutscloud	>= unspecified < c5.0.1.1949	c5.0.1.1949

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.