CVE-2018-19943 - If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code

Back Back to CVE browser

HIGH KEV

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code

Published Oct 28, 2020 ·Due Jun 14, 2022

8.0

HIGH

CVSS 3.1

EPSS 21.48%

Description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Affected products

Vendor QNAP Systems Inc. Product QTS Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.2.6
- Version
  unspecified
  Status
  affected
  Constraints
  <4.3.3.1252
- Version
  unspecified
  Status
  affected
  Constraints
  <4.3.4.1282
- Version
  unspecified
  Status
  affected
  Constraints
  <4.3.6.1263
- Version
  unspecified
  Status
  affected
  Constraints
  <4.4.1.1261
- Version
  unspecified
  Status
  affected
  Constraints
  <4.4.2.1270

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

QNAP Systems Inc.

QTS

n/a

Version	Status	Constraints
unspecified	affected	<4.2.6
unspecified	affected	<4.3.3.1252
unspecified	affected	<4.3.4.1282
unspecified	affected	<4.3.6.1263
unspecified	affected	<4.4.1.1261
unspecified	affected	<4.4.2.1270

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-80

References (2)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943
government-resourceUS Government Resource
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943		government-resourceUS Government Resource
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01		x_refsource_MISCVendor Advisory