CVE-2023-23367

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-23367
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://www.qnap.com/en/security-advisory/qsa-23-24 Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-24 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:qnap:qts:5.0.0.1716:build_20210701:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1785:build_20210908:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1808:build_20211001:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1828:build_20211020:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1837:build_20211029:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1850:build_20211111:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1853:build_20211114:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1858:build_20211119:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1870:build_20211201:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:qnap:quts_hero:h5.0.0.1772:build_20210826:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1844:build_20211105:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1856:build_20211117:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1892:build_20211222:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1900:build_20211228:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1949:build_20220215:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1986:build_20220324:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.2022:build_20220428:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.2069:build_20220614:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.2120:build_20220804:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:qnap:qutscloud:c5.0.0.1919:build_20220119:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.1949:build_20220218:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.1998:build_20220408:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.2044:build_20220524:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.2148:build_20220905:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.2374:build_20230419:*:*:*:*:*:*
History

21 Nov 2024, 07:46

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.2 		v2 : unknown
v3 : 4.7
References () https://www.qnap.com/en/security-advisory/qsa-23-24 - Vendor Advisory () https://www.qnap.com/en/security-advisory/qsa-23-24 - Vendor Advisory

21 Nov 2023, 03:08

Type Values Removed Values Added
First Time Qnap quts Hero
Qnap qutscloud
Qnap
Qnap qts
References () https://www.qnap.com/en/security-advisory/qsa-23-24 - () https://www.qnap.com/en/security-advisory/qsa-23-24 - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2
CPE cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1892:build_20211222:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1808:build_20211001:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1900:build_20211228:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1858:build_20211119:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.2022:build_20220428:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1837:build_20211029:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.1949:build_20220218:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1986:build_20220324:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1828:build_20211020:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.2044:build_20220524:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1785:build_20210908:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1716:build_20210701:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1850:build_20211111:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.2120:build_20220804:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1853:build_20211114:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1856:build_20211117:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.2374:build_20230419:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.2148:build_20220905:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1772:build_20210826:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.2069:build_20220614:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.1.1998:build_20220408:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1949:build_20220215:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0.1844:build_20211105:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c5.0.0.1919:build_20220119:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0.1870:build_20211201:*:*:*:*:*:*

10 Nov 2023, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-10 15:15

Updated : 2024-11-21 07:46

NVD link : CVE-2023-23367

Mitre link : CVE-2023-23367

CVE.ORG link : CVE-2023-23367

JSON object : View

Products Affected

qnap

  • qutscloud
  • qts
  • quts_hero
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024