CVE-2018-19943 is a vulnerability in QNAP Qts
Published on October 28, 2020
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
Known Exploited Vulnerability
This QNAP NAS File Station Cross-Site Scripting Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
The following remediation steps are recommended / required by June 14, 2022: Apply updates per vendor instructions.
Vulnerability Analysis
CVE-2018-19943 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2018-19943 has been classified to as a XSS vulnerability or weakness.
What is a Basic XSS Vulnerability?
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This may allow such characters to be treated as control characters, which are executed client-side in the context of the user's session. Although this can be classified as an injection problem, the more pertinent issue is the improper conversion of such special characters to respective context-appropriate entities before displaying them to the user.
CVE-2018-19943 has been classified to as a Basic XSS vulnerability or weakness.
Products Associated with CVE-2018-19943
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-19943 are published in QNAP Qts:
Affected Versions
QNAP Systems Inc. QTS:- Version unspecified and below 4.4.2.1270 is affected.
- Version unspecified and below 4.4.1.1261 is affected.
- Version unspecified and below 4.3.6.1263 is affected.
- Version unspecified and below 4.3.4.1282 is affected.
- Version unspecified and below 4.3.3.1252 is affected.
- Version unspecified and below 4.2.6 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.