All vulnerabilities
CVE-2018-19943

Network Attached Storage (NAS): QNAP NAS File Station Cross-Site Scripting Vulnerability

QNAP Network Attached Storage (NAS)Network & edge
Open in ThreatlineRecord JSON
CVSS
8.0High
ExploitationExploited in the wildAdded to KEV 24 May 2022. Known ransomware useCISA KEV
Exploit odds (EPSS)22.7%Chance of exploitation activity in the next 30 days, higher than 97% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.4.2.1270Also 4.4.1.1261, 4.3.6.1263 and 3 moreCVE List
Federal deadline14 Jun 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 28 Oct 2020, 17:55 UTCPublishedCVE List
  2. 24 May 2022Added to CISA KEVCISA KEV

Description

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

Text from CVE List

Affected versions 6

  • QTSaffected: unspecified before 4.4.2.1270CVE List
  • QTSaffected: unspecified before 4.4.1.1261CVE List
  • QTSaffected: unspecified before 4.3.6.1263CVE List
  • QTSaffected: unspecified before 4.3.4.1282CVE List
  • QTSaffected: unspecified before 4.3.3.1252CVE List
  • QTSaffected: unspecified before 4.2.6CVE List

References 3