Path Traversal in Music Station (<4.8.11, Fixed 4.8.11+)
CVE-2023-39299 Published on November 3, 2023

Music Station
A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: Music Station 4.8.11 and later Music Station 5.1.16 and later Music Station 5.3.23 and later

NVD

Vulnerability Analysis

CVE-2023-39299 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2023-39299 has been classified to as a Directory traversal vulnerability or weakness.


Products Associated with CVE-2023-39299

Want to know whenever a new CVE is published for QNAP Music Station? stack.watch will email you.

QNAP Music Station
 

Affected Versions

QNAP Systems Inc. Music Station: qnap music_station:

Exploit Probability

EPSS
0.13%
Percentile
32.47%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.