qnap qutscloud CVE-2021-38693 vulnerability in QNAP Products
Published on May 5, 2022

Path Traversal in thttpd
A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

NVD

Vulnerability Analysis

CVE-2021-38693 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2021-38693 has been classified to as a Directory traversal vulnerability or weakness.


Products Associated with CVE-2021-38693

Want to know whenever a new CVE is published for QNAP products? stack.watch will email you.

QNAP Qutscloud
 
QNAP Qts
 
QNAP Quts Hero
 

Affected Versions

QNAP Systems Inc. QuTScloud: QNAP Systems Inc. QuTS hero: QNAP Systems Inc. QTS:

Exploit Probability

EPSS
0.27%
Percentile
50.06%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.