CVE-2023-23362

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:46

Type Values Removed Values Added
References () https://www.qnap.com/en/security-advisory/qsa-23-18 - Vendor Advisory () https://www.qnap.com/en/security-advisory/qsa-23-18 - Vendor Advisory

26 Sep 2023, 14:03

Type Values Removed Values Added
CPE cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8
First Time Qnap qutscloud
Qnap
Qnap qts
Qnap quts Hero
References (MISC) https://www.qnap.com/en/security-advisory/qsa-23-18 - (MISC) https://www.qnap.com/en/security-advisory/qsa-23-18 - Vendor Advisory
CWE CWE-78

22 Sep 2023, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-09-22 04:15

Updated : 2024-11-21 07:46


NVD link : CVE-2023-23362

Mitre link : CVE-2023-23362

CVE.ORG link : CVE-2023-23362


JSON object : View

Products Affected

qnap

  • qts
  • qutscloud
  • quts_hero
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')