Vulnerability-Lookup

FKIE_CVE-2018-19942

Vulnerability from fkie_nvd - Published: 2021-04-16 01:15 - Updated: 2024-11-21 03:58

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)

References

	URL	Tags
	security@qnapsecurity.com.tw	https://www.qnap.com/zh-tw/security-advisory/qsa-21-04	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://www.qnap.com/zh-tw/security-advisory/qsa-21-04	Vendor Advisory

Impacted products

Vendor	Product	Version
qnap	qts	*
qnap	qts	*
qnap	qts	*
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.2.6
qnap	qts	4.3.3
qnap	qts	4.3.3.0095
qnap	qts	4.3.3.0096
qnap	qts	4.3.3.0136
qnap	qts	4.3.3.0154
qnap	qts	4.3.3.0174
qnap	qts	4.3.3.0188
qnap	qts	4.3.3.0210
qnap	qts	4.3.3.0229
qnap	qts	4.3.3.0238
qnap	qts	4.3.3.0262
qnap	qts	4.3.3.0299
qnap	qts	4.3.3.0351
qnap	qts	4.3.3.0353
qnap	qts	4.3.3.0361
qnap	qts	4.3.3.0369
qnap	qts	4.3.3.0378
qnap	qts	4.3.3.0396
qnap	qts	4.3.3.0404
qnap	qts	4.3.3.0416
qnap	qts	4.3.3.0418
qnap	qts	4.3.3.0448
qnap	qts	4.3.3.0514
qnap	qts	4.3.3.0546
qnap	qts	4.3.3.0570
qnap	qts	4.3.3.0868
qnap	qts	4.3.3.0998
qnap	qts	4.3.3.1051
qnap	qts	4.3.3.1098
qnap	qts	4.3.3.1161
qnap	qts	4.3.3.1252
qnap	qts	4.3.3.1315
qnap	qts	4.3.3.1386
qnap	qts	4.3.4
qnap	qts	4.3.4.0358
qnap	qts	4.3.4.0358
qnap	qts	4.3.4.0370
qnap	qts	4.3.4.0370
qnap	qts	4.3.4.0372
qnap	qts	4.3.4.0372
qnap	qts	4.3.4.0374
qnap	qts	4.3.4.0374
qnap	qts	4.3.4.0387
qnap	qts	4.3.4.0387
qnap	qts	4.3.4.0411
qnap	qts	4.3.4.0416
qnap	qts	4.3.4.0427
qnap	qts	4.3.4.0434
qnap	qts	4.3.4.0435
qnap	qts	4.3.4.0451
qnap	qts	4.3.4.0483
qnap	qts	4.3.4.0486
qnap	qts	4.3.4.0506
qnap	qts	4.3.4.0516
qnap	qts	4.3.4.0526
qnap	qts	4.3.4.0551
qnap	qts	4.3.4.0557
qnap	qts	4.3.4.0561
qnap	qts	4.3.4.0569
qnap	qts	4.3.4.0593
qnap	qts	4.3.4.0597
qnap	qts	4.3.4.0604
qnap	qts	4.3.4.0899
qnap	qts	4.3.4.1029
qnap	qts	4.3.4.1082
qnap	qts	4.3.4.1190
qnap	qts	4.3.4.1282
qnap	qts	4.3.4.1368
qnap	qts	4.3.4.1417
qnap	qts	4.3.6
qnap	qts	4.3.6.0895
qnap	qts	4.3.6.0907
qnap	qts	4.3.6.0923
qnap	qts	4.3.6.0944
qnap	qts	4.3.6.0959
qnap	qts	4.3.6.0979
qnap	qts	4.3.6.0993
qnap	qts	4.3.6.1013
qnap	qts	4.3.6.1033
qnap	qts	4.3.6.1070
qnap	qts	4.3.6.1154
qnap	qts	4.3.6.1218
qnap	qts	4.3.6.1263
qnap	qts	4.3.6.1286
qnap	qts	4.3.6.1333
qnap	qts	4.3.6.1411
qnap	qts	4.5.1
qnap	qts	4.5.2
qnap	quts_hero	*
qnap	quts_hero	h4.5.1
qnap	quts_hero	h4.5.1
qnap	qutscloud	*
qnap	qutscloud	c4.5.3
qnap	qutscloud	c4.5.4

JSON

To clipboard Create KEV Entry

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3777F6CC-9189-4BC0-B336-62BA1EFB91A7",
              "versionEndExcluding": "4.2.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E4CE6D6-F834-4B65-ADF9-E83C31270788",
              "versionEndExcluding": "4.3.6",
              "versionStartIncluding": "4.3.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "70A079A5-D3A6-408A-830E-4B5F3BA07EFA",
              "versionEndExcluding": "4.5.1",
              "versionStartIncluding": "4.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*",
              "matchCriteriaId": "2D3B1E3A-C9E9-4BB8-8BFC-AE1258722F85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*",
              "matchCriteriaId": "8F523E9F-D101-4C29-A624-74E1F3F8CB7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*",
              "matchCriteriaId": "1388DBE0-F6BB-44AB-81AC-BFB4E70BE820",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*",
              "matchCriteriaId": "CF3C4461-C1B6-43A1-BA5E-D6658EFD06EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*",
              "matchCriteriaId": "A1F11848-6FED-4D58-A177-36D280C0347C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*",
              "matchCriteriaId": "F6259C86-FFDA-40E8-AF0C-33CC8C108DC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*",
              "matchCriteriaId": "9E01E157-BDF1-4B00-BA9B-6887C0C7DFF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*",
              "matchCriteriaId": "1D1E5368-9587-4E0A-BB65-D88069CA8490",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*",
              "matchCriteriaId": "B63CE419-871C-4866-8AB1-4BB6461E1D74",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*",
              "matchCriteriaId": "886A71D1-9615-47A5-B3C2-CBC6F02961A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0095:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1ADCC83-5D09-4CF6-8C9C-42D440C683F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0096:*:*:*:*:*:*:*",
              "matchCriteriaId": "B40C2865-B92A-4BE2-921E-E69731764D28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0136:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DA27794-77A9-41B6-8A04-83C39D1892F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0154:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C30D1E2-AB9E-4E1D-BC7E-A9698CA2E7F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB10F6C0-7CB4-49D2-A1F7-9F3387CD1271",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0188:*:*:*:*:*:*:*",
              "matchCriteriaId": "4432295E-DDDE-49E6-AA5F-2B2D9749F5B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0210:*:*:*:*:*:*:*",
              "matchCriteriaId": "10A901AA-1A4E-4EB0-9CD2-8C377CDFB62B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0229:*:*:*:*:*:*:*",
              "matchCriteriaId": "E593CFA0-ABF0-4FF6-B2DE-735D68B2DA1D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0238:*:*:*:*:*:*:*",
              "matchCriteriaId": "60E989F4-5B0F-4F20-A722-5F2E299BAF86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0262:*:*:*:*:*:*:*",
              "matchCriteriaId": "A91C3567-D5D0-476C-B90A-E1D10DC7F6F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0299:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A37D998-D055-4FC6-98A9-FD59A9B7C199",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0351:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D849947-2C72-4665-A32F-3E3167B44FC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0353:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6DE1F84-922B-4286-B250-0A882822B15F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0361:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F112598-8DE0-4267-89ED-2501041EBCD8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0369:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB01E995-E8D2-4F16-B307-A436162E5E94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0378:*:*:*:*:*:*:*",
              "matchCriteriaId": "557915A4-6894-454B-A8D8-4897A12FB290",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0396:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3C12ADD-6091-4F55-A30C-48E54F07CFA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0404:*:*:*:*:*:*:*",
              "matchCriteriaId": "6034AF2C-BA1E-41E7-B0F5-191A6DCB7334",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0416:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA58E847-25D1-48AA-94CB-B4B15B2ACB96",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0418:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8C4062F-D82B-4193-B225-F5AFC13A16E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0448:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F46D76D-230D-41AC-B100-0B62B8404378",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0514:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5AA78A4-00D2-4168-8B48-0A23DD8B3C00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0546:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BAA1736-2B5E-4F7B-9DC0-065CF4EF9A60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0570:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE14B09E-69EE-479C-B523-D77C36A9D0D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:*",
              "matchCriteriaId": "1931A1D6-C1E6-410A-9F9E-9FD949D42C58",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:*",
              "matchCriteriaId": "77FFA90F-FDFA-4B73-960F-BEE7A92DB6BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:*",
              "matchCriteriaId": "491E9EA6-45FC-4D65-9C4E-AB62095DC861",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:*",
              "matchCriteriaId": "264B823B-E086-464E-A740-68BFB0AB8650",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5675D7E-1332-445B-BE5A-0506E765E99A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC246E80-7A88-4D91-989B-2922C70B1378",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8D69E0D-84C1-4988-9D73-2D3F511748D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F583384-38B8-4BB8-A957-BC6DBC145AEE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0C7D2D4-769F-4297-89F4-75366FFA7618",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0358:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1598EB2-E1B4-472F-909F-2C47618EE884",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0358:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "D560B30D-6A9F-4A44-B83B-4FAB02A94830",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0370:*:*:*:*:*:*:*",
              "matchCriteriaId": "A09397C1-338B-499C-BFB5-B758B4FF9617",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0370:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "ACB33269-7F69-45DA-9CF0-B0322FFC577D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0372:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B2D3D89-414E-46AA-8B02-B5FE969508D3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0372:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "3CABE783-B9CA-4E15-8DC2-75C39F214600",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0374:*:*:*:*:*:*:*",
              "matchCriteriaId": "46505B7D-7CF7-4EF0-B52E-18531BF33675",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0374:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "D8B39FE2-79A9-478C-AE83-8D9664A6D1F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0387:*:*:*:*:*:*:*",
              "matchCriteriaId": "B29246B7-AA5B-4BB2-B096-6B2798420FC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0387:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "DEA6AF09-BCB3-45EE-A59F-5A6CEFE8CBAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0411:*:*:*:*:*:*:*",
              "matchCriteriaId": "D339C9BA-E6DA-4116-B6E0-1C25F047FFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0416:*:*:*:*:*:*:*",
              "matchCriteriaId": "69859698-F815-489E-A08D-F1E2987C3F7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0427:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7BCBB16-EAAA-4184-B94C-3E2354BB4D50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0434:*:*:*:*:*:*:*",
              "matchCriteriaId": "55B35E45-D2B2-45D0-A018-002E5CACEB26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0435:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7DFA308-8071-4F4E-9457-2BBDF455D861",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0451:*:*:*:*:*:*:*",
              "matchCriteriaId": "94F95C29-9AB4-4204-831B-075413055289",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0483:*:*:*:*:*:*:*",
              "matchCriteriaId": "F556C8A6-8595-4207-93BF-2B1E8EEB2196",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0486:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F10A372-65BB-4FD6-940E-671022385757",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0506:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF9514B2-C366-418E-9659-8501ABD6E367",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0516:*:*:*:*:*:*:*",
              "matchCriteriaId": "995F09C6-D7C2-493D-815E-E837B371E2E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0526:*:*:*:*:*:*:*",
              "matchCriteriaId": "2BCCA5A5-C789-42FE-8652-F03618F095BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0551:*:*:*:*:*:*:*",
              "matchCriteriaId": "3230EF50-B2CC-4A4D-B353-7BE461BB235D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0557:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DC8B14B-3882-44C4-9CE8-C5D6FC0BE00A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0561:*:*:*:*:*:*:*",
              "matchCriteriaId": "D30204B8-097B-42EB-A7EC-9142F7D41EB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0569:*:*:*:*:*:*:*",
              "matchCriteriaId": "945AE50D-8745-42B2-9B89-04B21C98657B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0593:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BD98EC7-C26E-4AAB-AC6C-56A82C8C2432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0597:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FDBAE33-D3A8-46C7-8C4E-CB0C12ED08B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0604:*:*:*:*:*:*:*",
              "matchCriteriaId": "A99818FC-0BC5-45A9-AD55-C02FC0AB1959",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0899:*:*:*:*:*:*:*",
              "matchCriteriaId": "98DCB45E-6024-4BB6-A40A-1CB871343930",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.1029:*:*:*:*:*:*:*",
              "matchCriteriaId": "485AF3DC-126D-464C-A6ED-59746031BCC5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.1082:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1AF22BA-1772-4BFC-8BC1-3D626E14288F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.1190:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD0B2AE2-22D3-4E7A-9F0B-85E8DB82C632",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.1282:*:*:*:*:*:*:*",
              "matchCriteriaId": "483FE324-D554-4F10-B6A6-F2C7818FFB83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.1368:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB49B315-B381-47CD-AB70-A5D1DC7649E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.1417:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB92648C-7555-44B7-B35A-F1F1089B4740",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*",
              "matchCriteriaId": "A0E214BD-DC96-4B53-9BE7-8DD8F79B4542",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1AB2488-4D3D-494B-9C93-1AA3C7964644",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C24D008-D055-4A2C-88D4-85FB6DC45EFE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:*",
              "matchCriteriaId": "B64D1A6D-D306-46B8-B345-3D9C38544761",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:*",
              "matchCriteriaId": "067C0A13-525C-4376-A6CC-0B86F7F92670",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BAE62E0-5FA0-4B9F-ACCA-9C8C70AC1F2C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6023A8C-77A8-4B79-ACC6-872E98CA0D29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:*",
              "matchCriteriaId": "CAA72D06-4FE1-4DC3-A96B-2975A4A9AF84",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:*",
              "matchCriteriaId": "0CD59BCF-E119-4910-90CE-DCA212D146F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8F01168-A599-480D-BEB1-FA0195B696E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:*",
              "matchCriteriaId": "732218C9-0DD1-4153-BBC4-F9B8DDE03456",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEE80D8E-69F2-4AEB-85E1-1B4E64234A45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CC2FD13-427C-465C-A829-44224537B6D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:*",
              "matchCriteriaId": "15182D24-932E-4CC1-A791-DDFCF8B88C49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC7B2F4D-4FB2-4DC2-AE97-C6F3081A9A73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EB3E4B8-CF05-4EE2-A0DD-53FD50145893",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:*",
              "matchCriteriaId": "45C0ADAF-C42E-44EC-96B9-A8EA33AAB67D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "58596171-5A5E-4295-A987-DB29944F5877",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "D430FFFE-EEC5-4CA5-A70F-002F33019CDA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE4F1063-2A90-42A8-95A9-FD3D0FD4618F",
              "versionEndExcluding": "h4.5.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "548228B3-EB2C-42C1-895B-DA6DC5CA26EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:h4.5.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "CA4BA3AA-5273-431B-BCC1-F1CACA27AF53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE990E27-5A87-469B-AAD1-336445601DEA",
              "versionEndExcluding": "c4.5.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qutscloud:c4.5.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "FE793B49-71A9-4E0A-82C8-4E788193FAA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qutscloud:c4.5.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "2E83E97A-D58A-44E2-A2EA-8159836A5AFE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)"
    },
    {
      "lang": "es",
      "value": "Se ha reportado de una vulnerabilidad de cross-site scripting (XSS) que afecta a versiones anteriores de File Station.\u0026#xa0;Si es explotada, esta vulnerabilidad permite a atacantes remotos inyectar c\u00f3digo malicioso.\u0026#xa0;Ya hemos solucionado esta vulnerabilidad en las siguientes versiones: QTS versi\u00f3n 4.5.2.1566 build 20210202 (y posterior) QTS versi\u00f3n 4.5.1.1456 build 20201015 (y posterior) QTS versi\u00f3n 4.3.6.1446 build 20200929 (y posterior) QTS versi\u00f3n 4.3.4.1463 build 20201006 (y posterior ) QTS versi\u00f3n 4.3.3.1432 versi\u00f3n 20201006 (y posterior) QTS versi\u00f3n 4.2.6 build 20210327 (y posterior) QuTS hero versi\u00f3n h4.5.1.1472 build 20201031 (y posterior) QuTScloud versi\u00f3n c4.5.4.1601 build 20210309 (y posterior) QuTScloud versi\u00f3n c4.5.3.1454 build 20201013 (y posterior)"
    }
  ],
  "id": "CVE-2018-19942",
  "lastModified": "2024-11-21T03:58:51.297",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-04-16T01:15:12.020",
  "references": [
    {
      "source": "security@qnapsecurity.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-04"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-04"
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "security@qnapsecurity.com.tw",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2018-19942 (GCVE-0-2018-19942)

Vulnerability from cvelistv5 – Published: 2021-04-16 01:10 – Updated: 2024-09-16 20:32

Title

Cross-site Scripting Vulnerability in File Station

Summary

Severity ?

No CVSS data available.

CWE

CWE-79 - Cross-site Scripting (XSS)
CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

qnap

References

URL

Tags

https://www.qnap.com/zh-tw/security-advisory/qsa-21-04

x_refsource_MISC

Impacted products

Vendor

Product

Version

QNAP Systems Inc.

QTS

Affected: unspecified , < 4.5.2.1566 build 20210202 (custom)
Affected: unspecified , < 4.5.1.1456 build 20201015 (custom)
Affected: unspecified , < 4.3.6.1446 build 20200929 (custom)
Affected: unspecified , < 4.3.4.1463 build 20201006 (custom)
Affected: unspecified , < 4.3.3.1432 build 20201006 (custom)
Affected: unspecified , < 4.2.6 build 20210327 (custom)

	QNAP Systems Inc.	QuTS hero	Affected: unspecified , < h4.5.1.1472 build 20201031 (custom)
	QNAP Systems Inc.	QuTScloud	Affected: unspecified , < c4.5.4.1601 build 20210309 (custom) Affected: unspecified , < c4.5.3.1454 build 20201013 (custom)

Credits

Independent Security Evaluators

Show details on NVD website

JSON

To clipboard Create KEV Entry

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:17.849Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-04"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "4.5.2.1566 build 20210202",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.1456 build 20201015",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.6.1446 build 20200929",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.4.1463 build 20201006",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.3.1432 build 20201006",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.6 build 20210327",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "QuTS hero",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "h4.5.1.1472 build 20201031",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "QuTScloud",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "c4.5.4.1601 build 20210309",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "c4.5.3.1454 build 20201013",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Independent Security Evaluators"
        }
      ],
      "datePublic": "2021-04-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-16T01:10:13",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-04"
        }
      ],
      "source": {
        "advisory": "QSA-21-04",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting Vulnerability in File Station",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2021-04-16T00:45:00.000Z",
          "ID": "CVE-2018-19942",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting Vulnerability in File Station"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QTS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.5.2.1566 build 20210202"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.5.1.1456 build 20201015"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.3.6.1446 build 20200929"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.3.4.1463 build 20201006"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.3.3.1432 build 20201006"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.2.6 build 20210327"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "QuTS hero",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "h4.5.1.1472 build 20201031"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "QuTScloud",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "c4.5.4.1601 build 20210309"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "c4.5.3.1454 build 20201013"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP Systems Inc."
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Independent Security Evaluators"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-04",
              "refsource": "MISC",
              "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-04"
            }
          ]
        },
        "source": {
          "advisory": "QSA-21-04",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2018-19942",
    "datePublished": "2021-04-16T01:10:14.083307Z",
    "dateReserved": "2018-12-07T00:00:00",
    "dateUpdated": "2024-09-16T20:32:52.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2018-19942

CVE-2018-19942 (GCVE-0-2018-19942)

Tags

Sightings

Nomenclature