CVE-2023-32969

published 2024-03-08

CVE-2023-32969: A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated…

Priority P4 21 medium 4.8 CVSS 3.1

AV N AC L PR H UI R S C C L I L A N

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
QuTScloud c5.1.5.2651 and later
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later

Affected

8 ranges

Vendor	Product	Version range	Fixed in
qnap	qts	—	—
qnap	qts	>= 5.1.0 < 5.1.4.2596	5.1.4.2596
qnap	quts_hero	—	—
qnap	quts_hero	>= h5.1.0 < h5.1.4.2596	h5.1.4.2596
qnap	qutscloud	>= c5.0.0.1919 < c5.1.5.2651	c5.1.5.2651
qnap_systems_inc	qts	>= 5.1.x < 5.1.4.2596 build 20231128	5.1.4.2596 build 20231128
qnap_systems_inc	quts_hero	>= h5.1.x < h5.1.4.2596 build 20231128	h5.1.4.2596 build 20231128
qnap_systems_inc	qutscloud	>= c5.x.x < c5.1.5.2651	c5.1.5.2651

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79