Vulnerability-Lookup

CVE-2023-23362 (GCVE-0-2023-23362)

Vulnerability from cvelistv5 – Published: 2023-09-22 03:27 – Updated: 2024-09-24 18:12

Title

QTS, QuTS hero, QuTScloud

Summary

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78

Assigner

qnap

References

URL

Tags

https://www.qnap.com/en/security-advisory/qsa-23-18

Impacted products

Vendor

Product

Version

QNAP Systems Inc.

QTS

Affected: 5.0.* , < 5.0.1.2376 build 20230421 (custom)
Affected: 4.5.* , < 4.5.4.2374 build 20230416 (custom)

	QNAP Systems Inc.	QuTS hero	Affected: h5.0.* , < h5.0.1.2376 build 20230421 (custom) Affected: h4.5.* , < h4.5.4.2374 build 20230417 (custom)
	QNAP Systems Inc.	QuTScloud	Affected: c5.0.1 , < c5.0.1.2374 (custom)

Credits

YC of the M1QLin security team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:28:40.641Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.qnap.com/en/security-advisory/qsa-23-18"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-23362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:11:28.308907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:12:15.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "5.0.1.2376 build 20230421",
              "status": "affected",
              "version": "5.0.*",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.4.2374 build 20230416",
              "status": "affected",
              "version": "4.5.*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTS hero",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "h5.0.1.2376 build 20230421",
              "status": "affected",
              "version": "h5.0.*",
              "versionType": "custom"
            },
            {
              "lessThan": "h4.5.4.2374 build 20230417",
              "status": "affected",
              "version": "h4.5.*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTScloud",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "c5.0.1.2374",
              "status": "affected",
              "version": "c5.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "YC of the M1QLin security team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.0.1.2376 build 20230421 and later\u003cbr\u003eQTS 4.5.4.2374 build 20230416 and later\u003cbr\u003eQuTS hero h5.0.1.2376 build 20230421 and later\u003cbr\u003eQuTS hero h4.5.4.2374 build 20230417 and later\u003cbr\u003eQuTScloud c5.0.1.2374 and later\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2376 build 20230421 and later\nQTS 4.5.4.2374 build 20230416 and later\nQuTS hero h5.0.1.2376 build 20230421 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-15",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-15"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-22T03:27:19.075Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "url": "https://www.qnap.com/en/security-advisory/qsa-23-18"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.0.1.2376 build 20230421 and later\u003cbr\u003eQTS 4.5.4.2374 build 20230416 and later\u003cbr\u003eQuTS hero h5.0.1.2376 build 20230421 and later\u003cbr\u003eQuTS hero h4.5.4.2374 build 20230417 and later\u003cbr\u003eQuTScloud c5.0.1.2374 and later\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2376 build 20230421 and later\nQTS 4.5.4.2374 build 20230416 and later\nQuTS hero h5.0.1.2376 build 20230421 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later\n\n"
        }
      ],
      "source": {
        "advisory": "QSA-23-18",
        "discovery": "EXTERNAL"
      },
      "title": "QTS, QuTS hero, QuTScloud",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2023-23362",
    "datePublished": "2023-09-22T03:27:19.075Z",
    "dateReserved": "2023-01-11T20:15:53.085Z",
    "dateUpdated": "2024-09-24T18:12:15.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-23-18\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T10:28:40.641Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-23362\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-24T18:11:28.308907Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-24T18:12:11.058Z\"}}], \"cna\": {\"title\": \"QTS, QuTS hero, QuTScloud\", \"source\": {\"advisory\": \"QSA-23-18\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"YC of the M1QLin security team\"}], \"impacts\": [{\"capecId\": \"CAPEC-15\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-15\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QTS\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0.*\", \"lessThan\": \"5.0.1.2376 build 20230421\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.5.*\", \"lessThan\": \"4.5.4.2374 build 20230416\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTS hero\", \"versions\": [{\"status\": \"affected\", \"version\": \"h5.0.*\", \"lessThan\": \"h5.0.1.2376 build 20230421\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"h4.5.*\", \"lessThan\": \"h4.5.4.2374 build 20230417\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTScloud\", \"versions\": [{\"status\": \"affected\", \"version\": \"c5.0.1\", \"lessThan\": \"c5.0.1.2374\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"We have already fixed the vulnerability in the following versions:\\nQTS 5.0.1.2376 build 20230421 and later\\nQTS 4.5.4.2374 build 20230416 and later\\nQuTS hero h5.0.1.2376 build 20230421 and later\\nQuTS hero h4.5.4.2374 build 20230417 and later\\nQuTScloud c5.0.1.2374 and later\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.0.1.2376 build 20230421 and later\u003cbr\u003eQTS 4.5.4.2374 build 20230416 and later\u003cbr\u003eQuTS hero h5.0.1.2376 build 20230421 and later\u003cbr\u003eQuTS hero h4.5.4.2374 build 20230417 and later\u003cbr\u003eQuTScloud c5.0.1.2374 and later\u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-23-18\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 5.0.1.2376 build 20230421 and later\\nQTS 4.5.4.2374 build 20230416 and later\\nQuTS hero h5.0.1.2376 build 20230421 and later\\nQuTS hero h4.5.4.2374 build 20230417 and later\\nQuTScloud c5.0.1.2374 and later\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.0.1.2376 build 20230421 and later\u003cbr\u003eQTS 4.5.4.2374 build 20230416 and later\u003cbr\u003eQuTS hero h5.0.1.2376 build 20230421 and later\u003cbr\u003eQuTS hero h4.5.4.2374 build 20230417 and later\u003cbr\u003eQuTScloud c5.0.1.2374 and later\u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78\"}]}], \"providerMetadata\": {\"orgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"shortName\": \"qnap\", \"dateUpdated\": \"2023-09-22T03:27:19.075Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-23362\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-24T18:12:15.044Z\", \"dateReserved\": \"2023-01-11T20:15:53.085Z\", \"assignerOrgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"datePublished\": \"2023-09-22T03:27:19.075Z\", \"assignerShortName\": \"qnap\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2023-23362

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-23362

Aliases

CVE-2023-23362

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-23362",
    "id": "GSD-2023-23362"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-23362"
      ],
      "details": "An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2376 build 20230421 and later\nQTS 4.5.4.2374 build 20230416 and later\nQuTS hero h5.0.1.2376 build 20230421 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later\n\n",
      "id": "GSD-2023-23362",
      "modified": "2023-12-13T01:20:49.505645Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@qnap.com",
        "ID": "CVE-2023-23362",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "QTS",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "5.0.*",
                          "version_value": "5.0.1.2376 build 20230421"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "4.5.*",
                          "version_value": "4.5.4.2374 build 20230416"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "QuTS hero",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "h5.0.*",
                          "version_value": "h5.0.1.2376 build 20230421"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "h4.5.*",
                          "version_value": "h4.5.4.2374 build 20230417"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "QuTScloud",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "c5.0.1",
                          "version_value": "c5.0.1.2374"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "QNAP Systems Inc."
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "YC of the M1QLin security team"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2376 build 20230421 and later\nQTS 4.5.4.2374 build 20230416 and later\nQuTS hero h5.0.1.2376 build 20230421 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-78",
                "lang": "eng",
                "value": "CWE-78"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.qnap.com/en/security-advisory/qsa-23-18",
            "refsource": "MISC",
            "url": "https://www.qnap.com/en/security-advisory/qsa-23-18"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.0.1.2376 build 20230421 and later\u003cbr\u003eQTS 4.5.4.2374 build 20230416 and later\u003cbr\u003eQuTS hero h5.0.1.2376 build 20230421 and later\u003cbr\u003eQuTS hero h4.5.4.2374 build 20230417 and later\u003cbr\u003eQuTScloud c5.0.1.2374 and later\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2376 build 20230421 and later\nQTS 4.5.4.2374 build 20230416 and later\nQuTS hero h5.0.1.2376 build 20230421 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later\n\n"
        }
      ],
      "source": {
        "advisory": "QSA-23-18",
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "c5.0.1.2374",
                "versionStartIncluding": "c5.0.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.0.1.2376",
                "versionStartIncluding": "5.0.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.5.4.2374",
                "versionStartIncluding": "4.5.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "h4.5.4.2374",
                "versionStartIncluding": "h4.5.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "h5.0.1.2376",
                "versionStartIncluding": "h5.0.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "ID": "CVE-2023-23362"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2376 build 20230421 and later\nQTS 4.5.4.2374 build 20230416 and later\nQuTS hero h5.0.1.2376 build 20230421 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later\n\n"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-78"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/en/security-advisory/qsa-23-18",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.qnap.com/en/security-advisory/qsa-23-18"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-09-26T14:03Z",
      "publishedDate": "2023-09-22T04:15Z"
    }
  }
}

CERTFR-2023-AVI-0758

Vulnerability from certfr_avis - Published: 2023-09-18 - Updated: 2023-09-18

De multiples vulnérabilités ont été découvertes dans les produits Qnap. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance et une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Qnap	QuTS hero	QuTS hero versions antérieures à h5.0.1.2376 build 20230421
Qnap	QuTS hero	QuTS hero versions antérieures à h4.5.4.2374 build 20230417
Qnap	QTS	QTS versions antérieures à 4.5.4.2374 build 20230416
Qnap	QTS	QTS versions antérieures à 5.0.1.2376 build 20230421
Qnap	N/A	QuTScloud versions antérieures à c5.0.1.2374

References

Title

Publication Time

FKIE_CVE-2023-23362

Vulnerability from fkie_nvd - Published: 2023-09-22 04:15 - Updated: 2024-11-21 07:46

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@qnapsecurity.com.tw	https://www.qnap.com/en/security-advisory/qsa-23-18	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://www.qnap.com/en/security-advisory/qsa-23-18	Vendor Advisory

Impacted products

Vendor	Product	Version
qnap	qts	*
qnap	qts	*
qnap	quts_hero	*
qnap	quts_hero	*
qnap	qutscloud	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A2FA593-DD2F-4A3E-ABD1-3DDA45F280B9",
              "versionEndExcluding": "4.5.4.2374",
              "versionStartIncluding": "4.5.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBEFE8FD-0419-4951-9728-382FAD96C8C0",
              "versionEndExcluding": "5.0.1.2376",
              "versionStartIncluding": "5.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2A57CCE-9BB1-4E65-B4EC-97ECF574F326",
              "versionEndExcluding": "h4.5.4.2374",
              "versionStartIncluding": "h4.5.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEF85F30-5F30-4DE5-9DEF-ABCBE1A507B2",
              "versionEndExcluding": "h5.0.1.2376",
              "versionStartIncluding": "h5.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0837A154-0A11-481B-9356-B77387C53C2E",
              "versionEndIncluding": "c5.0.1.2374",
              "versionStartIncluding": "c5.0.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2376 build 20230421 and later\nQTS 4.5.4.2374 build 20230416 and later\nQuTS hero h5.0.1.2376 build 20230421 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later\n\n"
    },
    {
      "lang": "es",
      "value": "Se ha informado que una vulnerabilidad de inyecci\u00f3n de comandos del Sistema Operativo afecta a los sistemas operativos de QNAP. Si se explota, la vulnerabilidad permite a usuarios remotos autenticados ejecutar comandos a trav\u00e9s de dispositivos QNAP susceptibles. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.0.1.2376 compilaci\u00f3n 20230421 y posteriores QTS 4.5.4.2374 compilaci\u00f3n 20230416 y posteriores QuTS hero h5.0.1.2376 compilaci\u00f3n 20230421 y posteriores QuTS hero h4.5.4.2374 compilaci\u00f3n 20230417 y posteriores QuTScloud c5.0.1.2374 y posteriores"
    }
  ],
  "id": "CVE-2023-23362",
  "lastModified": "2024-11-21T07:46:01.773",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-09-22T04:15:50.487",
  "references": [
    {
      "source": "security@qnapsecurity.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/en/security-advisory/qsa-23-18"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/en/security-advisory/qsa-23-18"
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security@qnapsecurity.com.tw",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-VW76-R5H7-P4W9

Vulnerability from github – Published: 2023-09-22 06:30 – Updated: 2024-04-04 07:48

Details

We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-23362"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-22T04:15:50Z",
    "severity": "HIGH"
  },
  "details": "An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2376 build 20230421 and later\nQTS 4.5.4.2374 build 20230416 and later\nQuTS hero h5.0.1.2376 build 20230421 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later\n\n",
  "id": "GHSA-vw76-r5h7-p4w9",
  "modified": "2024-04-04T07:48:00Z",
  "published": "2023-09-22T06:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23362"
    },
    {
      "type": "WEB",
      "url": "https://www.qnap.com/en/security-advisory/qsa-23-18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-23362 (GCVE-0-2023-23362)

GSD-2023-23362

CERTFR-2023-AVI-0758

Solution

FKIE_CVE-2023-23362

GHSA-VW76-R5H7-P4W9

Tags

Sightings

Nomenclature