Vulnerability · Published Feb 2, 2024 · Assigned by qnap
CVE-2023-32967QTS, QuTScloud
Medium 5.0
In plain English
A medium-severity incorrect authorization in QTS from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. QTS 5.x, QuTS hero are not affected. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 4.5.4.2627 build 20231225 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | QuTScloud | c5.x.x – before c5.1.5.2651 |
| QNAP Systems Inc. | QTS | 4.5.x – before 4.5.4.2627 build 20231225 |
| QNAP Systems Inc. | QuTS hero | see references |
Weakness: CWE-863, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N