CVE-2018-19953 is a vulnerability in QNAP Qts
Published on October 28, 2020
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Known Exploited Vulnerability
This QNAP NAS File Station Cross-Site Scripting Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
The following remediation steps are recommended / required by June 14, 2022: Apply updates per vendor instructions.
Vulnerability Analysis
CVE-2018-19953 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Types
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2018-19953 has been classified to as a XSS vulnerability or weakness.
What is a Basic XSS Vulnerability?
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This may allow such characters to be treated as control characters, which are executed client-side in the context of the user's session. Although this can be classified as an injection problem, the more pertinent issue is the improper conversion of such special characters to respective context-appropriate entities before displaying them to the user.
CVE-2018-19953 has been classified to as a Basic XSS vulnerability or weakness.
Products Associated with CVE-2018-19953
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-19953 are published in QNAP Qts:
Affected Versions
QNAP Systems Inc. QTS:- Version unspecified and below 4.4.2.1231 is affected.
- Version unspecified and below 4.4.1.1201 is affected.
- Version unspecified and below 4.3.6.1218 is affected.
- Version unspecified and below 4.3.4.1190 is affected.
- Version unspecified and below 4.3.3.1161 is affected.
- Version unspecified and below 4.2.6 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.