{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-32970", "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "state": "PUBLISHED", "assignerShortName": "qnap", "dateReserved": "2023-05-16T10:44:49.055Z", "datePublished": "2023-10-13T19:16:18.592Z", "dateUpdated": "2023-10-13T19:16:18.592Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "QuTS hero", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "h5.0.1.2515 build 20230907", "status": "affected", "version": "h5.0.x", "versionType": "custom"}, {"lessThan": "h5.1.0.2453 build 20230708", "status": "affected", "version": "h5.1.x", "versionType": "custom"}, {"lessThan": "h4.5.4.2476 build 20230728", "status": "affected", "version": "h4.5.x", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "QuTScloud", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "c5.1.0.2498", "status": "affected", "version": "c5.x", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "5.1.0.2444 build 20230629", "status": "affected", "version": "5.1.x", "versionType": "custom"}, {"lessThan": "4.5.4.2467 build 20230718", "status": "affected", "version": "4.5.x", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jiaxu Zhao && Bingwei Peng"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.<br>QES is not affected.<br><br>We have already fixed the vulnerability in the following versions:<br>QuTS hero h5.0.1.2515 build 20230907 and later<br>QuTS hero h5.1.0.2453 build 20230708 and later<br>QuTS hero h4.5.4.2476 build 20230728 and later<br>QuTScloud c5.1.0.2498 and later<br>QTS 5.1.0.2444 build 20230629 and later<br>QTS 4.5.4.2467 build 20230718 and later<br>"}], "value": "A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.\nQES is not affected.\n\nWe have already fixed the vulnerability in the following versions:\nQuTS hero h5.0.1.2515 build 20230907 and later\nQuTS hero h5.1.0.2453 build 20230708 and later\nQuTS hero h4.5.4.2476 build 20230728 and later\nQuTScloud c5.1.0.2498 and later\nQTS 5.1.0.2444 build 20230629 and later\nQTS 4.5.4.2467 build 20230718 and later\n"}], "impacts": [{"capecId": "CAPEC-129", "descriptions": [{"lang": "en", "value": "CAPEC-129"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap", "dateUpdated": "2023-10-13T19:16:18.592Z"}, "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-23-41"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "We have already fixed the vulnerability in the following versions:<br>QuTS hero h5.0.1.2515 build 20230907 and later<br>QuTS hero h5.1.0.2453 build 20230708 and later<br>QuTS hero h4.5.4.2476 build 20230728 and later<br>QuTScloud c5.1.0.2498 and later<br>QTS 5.1.0.2444 build 20230629 and later<br>QTS 4.5.4.2467 build 20230718 and later<br>"}], "value": "We have already fixed the vulnerability in the following versions:\nQuTS hero h5.0.1.2515 build 20230907 and later\nQuTS hero h5.1.0.2453 build 20230708 and later\nQuTS hero h4.5.4.2476 build 20230728 and later\nQuTScloud c5.1.0.2498 and later\nQTS 5.1.0.2444 build 20230629 and later\nQTS 4.5.4.2467 build 20230718 and later\n"}], "source": {"advisory": "QSA-23-41", "discovery": "EXTERNAL"}, "title": "QTS, QuTS hero, QuTScloud", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "01EE6DE4-F216-49F8-9961-3DF29E7D9109", "versionEndExcluding": "4.5.4.2467", "versionStartIncluding": "4.5.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "5512CD56-38D0-4575-B863-603523C8A020", "versionEndExcluding": "5.0.1.2425", "versionStartIncluding": "5.0.0.1716", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "834347F5-87D2-479E-81BF-C5F23534E0F2", "versionEndExcluding": "5.1.0.2444", "versionStartIncluding": "5.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "matchCriteriaId": "039CB063-5347-4F85-B6DE-430A94C0B3DD", "versionEndExcluding": "h4.5.4.2476", "versionStartIncluding": "h4.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "matchCriteriaId": "703732BD-834B-4529-A2E8-AF956F5AD674", "versionEndExcluding": "h5.0.1.2515", "versionStartIncluding": "h5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "matchCriteriaId": "757BF20E-81DA-447A-B90C-06D096EBACD1", "versionEndExcluding": "h5.1.0.2424", "versionStartIncluding": "h5.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D504C77-393C-4298-9B8E-4408FAA067E1", "versionEndExcluding": "c5.1.0.2498", "versionStartIncluding": "c5.0.0.1919", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.\nQES is not affected.\n\nWe have already fixed the vulnerability in the following versions:\nQuTS hero h5.0.1.2515 build 20230907 and later\nQuTS hero h5.1.0.2453 build 20230708 and later\nQuTS hero h4.5.4.2476 build 20230728 and later\nQuTScloud c5.1.0.2498 and later\nQTS 5.1.0.2444 build 20230629 and later\nQTS 4.5.4.2467 build 20230718 and later\n"}, {"lang": "es", "value": "Se ha informado que una vulnerabilidad de desreferencia del puntero NULL afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los administradores autenticados lanzar un ataque de Denegaci\u00f3n de Servicio (DoS) a trav\u00e9s de una red. QES no se ve afectado. Ya se ha solucionado la vulnerabilidad en las siguientes versiones: QuTS hero h5.0.1.2515 build 20230907 y posteriores QuTS hero h5.1.0.2453 build 20230708 y posteriores QuTS hero h4.5.4.2476 build 20230728 y posteriores QuTScloud c5.1.0.2498 y posteriores QTS 5.1.0.2444 build 20230629 y posteriores QTS 4.5.4.2467 build 20230718 y posteriores"}], "id": "CVE-2023-32970", "lastModified": "2023-10-19T15:42:09.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@qnapsecurity.com.tw", "type": "Secondary"}]}, "published": "2023-10-13T20:15:09.830", "references": [{"source": "security@qnapsecurity.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/en/security-advisory/qsa-23-41"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-476"}], "source": "security@qnapsecurity.com.tw", "type": "Secondary"}]}

{}