CVE-2024-21902

{"id": "CVE-2024-21902", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "published": "2024-05-21T16:15:24.743", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-23", "tags": ["Vendor Advisory"], "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.1.7.2770 build 20240520 and later\nQuTS hero h5.1.7.2770 build 20240520 and later"}, {"lang": "es", "value": " Se ha informado que una vulnerabilidad de asignaci\u00f3n incorrecta de permisos para recursos cr\u00edticos afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los usuarios autenticados leer o modificar el recurso a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en la siguiente versi\u00f3n: QTS 5.1.7.2770 build 20240520 y posteriores QuTS hero h5.1.7.2770 build 20240520 y posteriores"}], "lastModified": "2024-09-11T13:37:37.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39382CBA-EA68-426A-AC07-A9A26E722CAB"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCB37C08-1DF7-4AF4-9BB1-C562E5643B5A"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8368130C-F26D-41FE-8D78-B103A23B5327"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E0EE181-78AF-4C3C-90A4-C69A2DE6E176"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56E3AE06-78DA-4844-ADC1-09A35F1C5B54"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2AA7A32-0DA8-4417-A23E-C4F563BC7819"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E7C17C-ED6D-439D-A1F3-1870A3ADA926"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.3.2578:build_20231110:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "636C2D9C-C837-4FAC-B79D-1CA7A7C1FF3E"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.4.2596:build_20231128:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "866B455B-0266-4990-920B-A06756ED5A61"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.5.2645:build_20240116:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3B5C4C5-5EE2-4E6F-927E-1D52A04895BB"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.5.2679:build_20240219:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "543E17BB-B552-4B65-B028-BE9A47E6F34B"}, {"criteria": "cpe:2.3:o:qnap:qts:5.1.6.2722:build_20240402:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEDC247A-96D9-4140-AA72-52E4EEDC2121"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CA398A8-EBDF-4D41-B15E-7B763F885021"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F63A5ED2-ECC2-49A0-BFA9-548E35ACD6C7"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53387FAC-7BE0-47D7-99BF-2B1F03C17CC3"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4226394-0023-4CD2-BB89-77251BF92FF3"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "646257F7-D4A4-43B0-91F2-7850338B3CA1"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.2.2534:build_20230927:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88825AE1-B006-4F7F-BD90-D4B1CF1251A3"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:build_20231110:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F471666-4919-4770-956E-ACE4C55D29DB"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.4.2596:build_20231128:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9573F671-D49E-438A-B72C-DFC390A79093"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:build_20240118:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75E7938F-943F-428D-974D-42E790829F88"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.5.2680:build_20240220:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12F5732D-C95F-45D1-968C-C2269DFDF6D4"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.6.2734:build_20240414:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94734596-A56A-4128-A39A-7E22FBD17835"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}