CVE-2024-38640

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
7.0HIGH
EPSS
1.0%
top 22.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Qnap Systems Inc. Download StationQnap Download Station
Timeline
PublishedSep 6

Description

A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Download Station 5.8.6.283 ( 2024/06/21 ) and later

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDqnap/download_station5.8.0 — 5.8.6.283
▶CVEListV5qnap_systems_inc./download_station5.8.x — 5.8.6.283 ( 2024/06/21 )

🔴Vulnerability Details

2
CVEList
Download Station↗2024-09-06
▶
GHSA
GHSA-58rh-53vh-8w68: A cross-site scripting (XSS) vulnerability has been reported to affect Download Station↗2024-09-06
▶
CVE-2024-38640 (HIGH CVSS 7) | A cross-site scripting (XSS) vulner | cvebase.io