Log in Start free

Vulnerability · Published Jun 3, 2021 · Assigned by qnap

CVE-2021-28807Post-Authentication Reflected XSS Vulnerability in Q'center

High 7.7

In plain English

A high-severity cross-site scripting in Q’center from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)1.4%top 27.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later

Affected products (as reported)

VendorProductVersions
QNAP Systems Inc. Q’center unspecified – before v1.12.1012
QNAP Systems Inc. Q’center unspecified – before v1.10.1004
QNAP Systems Inc. Q’center unspecified – before v1.10.1004
QNAP Systems Inc. Q’center unspecified – before v1.12.1012
QNAP Systems Inc. Q’center unspecified – before v1.12.1012

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References