{"containers": {"cna": {"affected": [{"product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"status": "affected", "version": "< 4.5.1.1456"}, {"status": "affected", "version": "< 4.4.3.1354"}, {"status": "affected", "version": "< 4.3.6.1333"}, {"status": "affected", "version": "< 4.3.4.1368"}, {"status": "affected", "version": "< 4.3.3.1315"}, {"status": "affected", "version": "< 4.2.6"}]}, {"product": "QuTS hero", "vendor": "QNAP Systems Inc.", "versions": [{"status": "affected", "version": "< h4.5.1.1472"}]}], "credits": [{"lang": "en", "value": "Jan Hoff"}], "datePublic": "2020-12-07T00:00:00", "descriptions": [{"lang": "en", "value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-12-10T03:43:11", "orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.qnap.com/en/security-advisory/qsa-20-12"}], "solutions": [{"lang": "en", "value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"}], "source": {"advisory": "QSA-20-12", "discovery": "EXTERNAL"}, "title": "Cross-site scripting vulnerability in QTS and QuTS hero", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@qnap.com", "DATE_PUBLIC": "2020-12-07T00:29:00.000Z", "ID": "CVE-2020-2497", "STATE": "PUBLIC", "TITLE": "Cross-site scripting vulnerability in QTS and QuTS hero"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "QTS", "version": {"version_data": [{"version_value": "< 4.5.1.1456"}, {"version_value": "< 4.4.3.1354"}, {"version_value": "< 4.3.6.1333"}, {"version_value": "< 4.3.4.1368"}, {"version_value": "< 4.3.3.1315"}, {"version_value": "< 4.2.6"}]}}, {"product_name": "QuTS hero", "version": {"version_data": [{"version_value": "< h4.5.1.1472"}]}}]}, "vendor_name": "QNAP Systems Inc."}]}}, "credit": [{"lang": "eng", "value": "Jan Hoff"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}, {"description": [{"lang": "eng", "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}]}, "references": {"reference_data": [{"name": "https://www.qnap.com/en/security-advisory/qsa-20-12", "refsource": "CONFIRM", "url": "https://www.qnap.com/en/security-advisory/qsa-20-12"}]}, "solution": [{"lang": "en", "value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"}], "source": {"advisory": "QSA-20-12", "discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "assignerShortName": "qnap", "cveId": "CVE-2020-2497", "datePublished": "2020-12-07T00:00:00", "dateReserved": "2019-12-09T00:00:00", "dateUpdated": "2020-12-10T03:43:11", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACABFEAE-2A93-4E81-9F73-706FEE68C1DF", "versionEndExcluding": "4.5.1.1472", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DF58F11-5E71-4EFB-8039-B4EA21C2C810", "versionEndExcluding": "4.5.1.1456", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C993531-A910-4F15-ABD3-31261D560C76", "versionEndExcluding": "4.4.3.1354", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "CED08145-C2CF-484B-B66D-5469591040E8", "versionEndExcluding": "4.3.6.1333", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA15CC08-00FA-4682-8DD9-0B1AF10E40E7", "versionEndExcluding": "4.3.4.1368", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "87533C7A-38F8-4487-A753-EBB911F2A76C", "versionEndExcluding": "4.3.3.1315", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "3777F6CC-9189-4BC0-B336-62BA1EFB91A7", "versionEndExcluding": "4.2.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"}, {"lang": "es", "value": "Si era explotada, esta vulnerabilidad de tipo cross-site scripting podr\u00eda permitir a atacantes remotos inyectar c\u00f3digo malicioso en System Connection Logs.&#xa0;QNAP ya ha corregido estas vulnerabilidades en las siguientes versiones de QTS y QuTS hero.&#xa0;QuTS hero versi\u00f3n h4.5.1.1472 build 20201031 y posterior, QTS versi\u00f3n 4.5.1.1456 build 20201015 y posterior, QTS versi\u00f3n 4.4.3.1354 build 20200702 y posterior, QTS versi\u00f3n 4.3.6.1333 build 20200608 y posterior, QTS versi\u00f3n 4.3.4.1368 build 20200703 y posterior, QTS versi\u00f3n 4.3.3.1315 build 20200611 y posterior, QTS versi\u00f3n 4.2.6 build 20200611 y posterior"}], "id": "CVE-2020-2497", "lastModified": "2021-06-22T21:00:59.687", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-10T04:15:11.987", "references": [{"source": "security@qnapsecurity.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/en/security-advisory/qsa-20-12"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}], "source": "security@qnapsecurity.com.tw", "type": "Secondary"}]}

{}