Actively exploited · Published Oct 28, 2020 · Assigned by qnap
CVE-2018-19943
High 8.0 Exploited Ransomware
In plain English
A high-severity cross-site scripting in QTS from QNAP Systems Inc.. Attackers are actively exploiting it in the wild (listed by CISA on May 24, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 22.7% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 14, 2022.
Official description
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | QTS | unspecified – before 4.4.2.1270 |
| QNAP Systems Inc. | QTS | unspecified – before 4.4.1.1261unspecified – before 4.3.6.1263 |
| QNAP Systems Inc. | QTS | unspecified – before 4.3.4.1282 |
| QNAP Systems Inc. | QTS | unspecified – before 4.3.3.1252 |
| QNAP Systems Inc. | QTS | unspecified – before 4.2.6 |
Weakness: CWE-79, CWE-80 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
References
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-01 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943 government-resource