CVE-2023-32974

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTScloud c5.1.0.2498 and later

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-23-42	Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-42	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:qnap:qts::::::::
	cpe:2.3:o:qnap:quts_hero::::::::
	cpe:2.3:o:qnap:qutscloud::::::::

History

21 Nov 2024, 08:04

Type	Values Removed	Values Added
References	~~() https://www.qnap.com/en/security-advisory/qsa-23-42 - Vendor Advisory~~	() https://www.qnap.com/en/security-advisory/qsa-23-42 - Vendor Advisory

19 Oct 2023, 15:58

Type	Values Removed	Values Added
First Time		Qnap qutscloud Qnap Qnap qts Qnap quts Hero
References	~~(MISC) https://www.qnap.com/en/security-advisory/qsa-23-42 -~~	(MISC) https://www.qnap.com/en/security-advisory/qsa-23-42 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CWE		CWE-22
CPE		cpe:2.3:o:qnap:quts_hero:::::::: cpe:2.3:o:qnap:qutscloud:::::::: cpe:2.3:o:qnap:qts::::::::

13 Oct 2023, 21:31

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-13 20:15

Updated : 2024-11-21 08:04

NVD link : CVE-2023-32974

Mitre link : CVE-2023-32974

CVE.ORG link : CVE-2023-32974

JSON object : View

Products Affected

qnap

qts
qutscloud
quts_hero

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2023-32974", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-10-13T20:15:10.007", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-23-42", "tags": ["Vendor Advisory"], "source": "security@qnapsecurity.com.tw"}, {"url": "https://www.qnap.com/en/security-advisory/qsa-23-42", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.0.2444 build 20230629 and later\nQuTS hero h5.1.0.2424 build 20230609 and later\nQuTScloud c5.1.0.2498 and later\n"}, {"lang": "es", "value": "Se ha informado que una vulnerabilidad de path traversal afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los usuarios leer el contenido de archivos inesperados y exponer datos confidenciales a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.0.2444 build 20230629 y posteriores QuTS hero h5.1.0.2424 build 20230609 y posteriores QuTScloud c5.1.0.2498 y posteriores"}], "lastModified": "2024-11-21T08:04:19.567", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "834347F5-87D2-479E-81BF-C5F23534E0F2", "versionEndExcluding": "5.1.0.2444", "versionStartIncluding": "5.1.0"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "757BF20E-81DA-447A-B90C-06D096EBACD1", "versionEndExcluding": "h5.1.0.2424", "versionStartIncluding": "h5.1.0"}, {"criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D504C77-393C-4298-9B8E-4408FAA067E1", "versionEndExcluding": "c5.1.0.2498", "versionStartIncluding": "c5.0.0.1919"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}