Vulnerability · Published Mar 8, 2024 · Assigned by qnap
CVE-2024-21901myQNAPcloud
Medium 4.7
In plain English
A medium-severity SQL injection in myQNAPcloud from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 18.7% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)18.7%top 2.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 ( 2023/11/24 ) and later QTS 4.5.4.2627 build 20231225 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | myQNAPcloud | 1.0.x – before 1.0.52 ( 2023/11/24 ) |
| QNAP Systems Inc. | QTS | 4.5.x – before 4.5.4.2627 build 20231225 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L