Vulnerability · Published Jan 7, 2022 · Assigned by qnap

CVE-2021-38674Reflected XSS Vulnerability in TFTP

Medium 4.2

In plain English

A medium-severity cross-site scripting in QTS from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.7%top 48.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later

Affected products (as reported)

Vendor	Product	Versions
QNAP Systems Inc.	QuTS hero	unspecified – before h4.5.4.1771 build 20210825
QNAP Systems Inc.	QTS	unspecified – before 4.5.4.1787 build 20210910
QNAP Systems Inc.	QuTScloud	unspecified – before c4.5.7.1864

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://www.qnap.com/en/security-advisory/qsa-21-63 x_refsource_MISC