CVE-2020-36195 (GCVE-0-2020-36195)

Vulnerability from cvelistv5 – Published: 2021-04-17 03:50 – Updated: 2024-09-16 17:28
VLAI
Title
SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On
Summary
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-20 - Improper Input Validation
  • CWE-89 - SQL Injection
  • CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
Impacted products
Vendor Product Version CPE status
QNAP Systems Inc. QTS Affected: unspecified , < 4.3.3.1624 Build 20210416 (custom)
Affected: unspecified , < 4.3.6.1620 Build 20210322 (custom)
guessed Create a notification for this product.
QNAP Systems Inc. Media Streaming add-on Affected: unspecified , < 430.1.8.10 (custom)
Affected: unspecified , < 430.1.8.8 (custom)
guessed Create a notification for this product.
QNAP Systems Inc. Multimedia Console Affected: unspecified , < 1.3.4 (custom)
guessed Create a notification for this product.
Date Public
2021-04-16 00:00
Credits
Yaniv Puyeski
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:23:09.536Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/en/security-advisory/qsa-21-11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "4.3.3.1624 Build 20210416",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.6.1620 Build 20210322",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Media Streaming add-on",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "430.1.8.10",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "430.1.8.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Multimedia Console",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "1.3.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaniv Puyeski"
        }
      ],
      "datePublic": "2021-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943 Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-17T03:50:13.000Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qnap.com/en/security-advisory/qsa-21-11"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on.\n\nQTS 4.3.3: Media Streaming add-on 430.1.8.10 and later\nQTS 4.3.6: Media Streaming add-on 430.1.8.8 and later\nQTS 4.4.x and later: Multimedia Console 1.3.4 and later\n\nWe have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively:\n\nQTS 4.3.3.1624 Build 20210416 or later\nQTS 4.3.6.1620 Build 20210322 or later"
        }
      ],
      "source": {
        "advisory": "QSA-21-11",
        "discovery": "EXTERNAL"
      },
      "title": "SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2021-04-16T03:33:00.000Z",
          "ID": "CVE-2020-36195",
          "STATE": "PUBLIC",
          "TITLE": "SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QTS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.3.3.1624 Build 20210416"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.3.6.1620 Build 20210322"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Media Streaming add-on",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "430.1.8.10"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "430.1.8.8"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Multimedia Console",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.3.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP Systems Inc."
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Yaniv Puyeski"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20 Improper Input Validation"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-943 Improper Neutralization of Special Elements in Data Query Logic"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/en/security-advisory/qsa-21-11",
              "refsource": "MISC",
              "url": "https://www.qnap.com/en/security-advisory/qsa-21-11"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on.\n\nQTS 4.3.3: Media Streaming add-on 430.1.8.10 and later\nQTS 4.3.6: Media Streaming add-on 430.1.8.8 and later\nQTS 4.4.x and later: Multimedia Console 1.3.4 and later\n\nWe have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively:\n\nQTS 4.3.3.1624 Build 20210416 or later\nQTS 4.3.6.1620 Build 20210322 or later"
          }
        ],
        "source": {
          "advisory": "QSA-21-11",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2020-36195",
    "datePublished": "2021-04-17T03:50:13.274Z",
    "dateReserved": "2021-01-19T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:28:07.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-36195",
      "date": "2026-09-25",
      "epss": "0.01765",
      "percentile": "0.77112"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "49B8CCE7-9635-4E7E-8C06-7928D42EA356",
                  "versionEndExcluding": "4.3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A8CA5A88-434F-4F66-9374-FF5660D5243E",
                  "versionEndExcluding": "4.3.6",
                  "versionStartIncluding": "4.3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0095:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D1ADCC83-5D09-4CF6-8C9C-42D440C683F2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0096:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B40C2865-B92A-4BE2-921E-E69731764D28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0136:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8DA27794-77A9-41B6-8A04-83C39D1892F8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0154:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5C30D1E2-AB9E-4E1D-BC7E-A9698CA2E7F2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DB10F6C0-7CB4-49D2-A1F7-9F3387CD1271",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0188:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4432295E-DDDE-49E6-AA5F-2B2D9749F5B9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0210:*:*:*:*:*:*:*",
                  "matchCriteriaId": "10A901AA-1A4E-4EB0-9CD2-8C377CDFB62B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0229:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E593CFA0-ABF0-4FF6-B2DE-735D68B2DA1D",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0238:*:*:*:*:*:*:*",
                  "matchCriteriaId": "60E989F4-5B0F-4F20-A722-5F2E299BAF86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0262:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A91C3567-D5D0-476C-B90A-E1D10DC7F6F7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0299:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5A37D998-D055-4FC6-98A9-FD59A9B7C199",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0351:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8D849947-2C72-4665-A32F-3E3167B44FC0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0353:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D6DE1F84-922B-4286-B250-0A882822B15F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0361:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3F112598-8DE0-4267-89ED-2501041EBCD8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0369:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EB01E995-E8D2-4F16-B307-A436162E5E94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0378:*:*:*:*:*:*:*",
                  "matchCriteriaId": "557915A4-6894-454B-A8D8-4897A12FB290",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0396:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D3C12ADD-6091-4F55-A30C-48E54F07CFA9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0404:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6034AF2C-BA1E-41E7-B0F5-191A6DCB7334",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0416:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DA58E847-25D1-48AA-94CB-B4B15B2ACB96",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0418:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A8C4062F-D82B-4193-B225-F5AFC13A16E4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0448:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4F46D76D-230D-41AC-B100-0B62B8404378",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0514:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A5AA78A4-00D2-4168-8B48-0A23DD8B3C00",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0546:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4BAA1736-2B5E-4F7B-9DC0-065CF4EF9A60",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0570:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BE14B09E-69EE-479C-B523-D77C36A9D0D2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:*",
                  "matchCriteriaId": "1931A1D6-C1E6-410A-9F9E-9FD949D42C58",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:*",
                  "matchCriteriaId": "77FFA90F-FDFA-4B73-960F-BEE7A92DB6BA",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:*",
                  "matchCriteriaId": "491E9EA6-45FC-4D65-9C4E-AB62095DC861",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:*",
                  "matchCriteriaId": "264B823B-E086-464E-A740-68BFB0AB8650",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A5675D7E-1332-445B-BE5A-0506E765E99A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DC246E80-7A88-4D91-989B-2922C70B1378",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C8D69E0D-84C1-4988-9D73-2D3F511748D0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6F583384-38B8-4BB8-A957-BC6DBC145AEE",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1432:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D7D05B71-CAF6-416F-BF92-AB4934474F26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*",
                  "matchCriteriaId": "A0E214BD-DC96-4B53-9BE7-8DD8F79B4542",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A1AB2488-4D3D-494B-9C93-1AA3C7964644",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6C24D008-D055-4A2C-88D4-85FB6DC45EFE",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B64D1A6D-D306-46B8-B345-3D9C38544761",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:*",
                  "matchCriteriaId": "067C0A13-525C-4376-A6CC-0B86F7F92670",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4BAE62E0-5FA0-4B9F-ACCA-9C8C70AC1F2C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B6023A8C-77A8-4B79-ACC6-872E98CA0D29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CAA72D06-4FE1-4DC3-A96B-2975A4A9AF84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0CD59BCF-E119-4910-90CE-DCA212D146F5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E8F01168-A599-480D-BEB1-FA0195B696E6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:*",
                  "matchCriteriaId": "732218C9-0DD1-4153-BBC4-F9B8DDE03456",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FEE80D8E-69F2-4AEB-85E1-1B4E64234A45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4CC2FD13-427C-465C-A829-44224537B6D8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:*",
                  "matchCriteriaId": "15182D24-932E-4CC1-A791-DDFCF8B88C49",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FC7B2F4D-4FB2-4DC2-AE97-C6F3081A9A73",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4EB3E4B8-CF05-4EE2-A0DD-53FD50145893",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:*",
                  "matchCriteriaId": "45C0ADAF-C42E-44EC-96B9-A8EA33AAB67D",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1446:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E4A24254-768F-4538-9DD8-26DCDEECF7CF",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9AEE9529-C81D-4EC1-A68D-324B2439546C",
                  "versionEndExcluding": "430.1.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E7A76370-2638-4C00-A0BB-42EAC33D2293",
                  "versionEndExcluding": "430.1.8.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:qnap:multimedia_console:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E40D0A81-501F-4ED6-895A-193B0D93217D",
                  "versionEndExcluding": "1.3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C0CDD34B-E2E5-40AB-B6BE-C90B65BE7BF1",
                  "versionStartIncluding": "4.4.0",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later"
        },
        {
          "lang": "es",
          "value": "Se ha reportado de una vulnerabilidad de inyecci\u00f3n SQL que afecta al NAS de QNAP que ejecuta Multimedia Console o el add-on Media Streaming. Si se explota, la vulnerabilidad permite a atacantes remotos obtener informaci\u00f3n de la aplicaci\u00f3n.\u0026#xa0;QNAP ya ha corregido esta vulnerabilidad en las siguientes versiones de Multimedia Console y el add-on Media Streaming. QTS versi\u00f3n 4.3.3: add-on Media Streaming versiones 430.1.8.10 y posteriores. QTS versi\u00f3n 4.3.6: add-on Media Streaming versiones 430.1.8.8 y posteriores. QTS versiones 4.4.x y posteriores. Multimedia Console versiones 1.3.4 y posteriores. Tambi\u00e9n hemos corregido esta vulnerabilidad en las siguientes versiones de QTS 4.3.3 y QTS 4.3.6, respectivamente: QTS versi\u00f3n 4.3.3.1624 Build 20210416 o posteriores. QTS versiones 4.3.6.1620 Build 20210322 o posteriores"
        }
      ],
      "id": "CVE-2020-36195",
      "lastModified": "2024-11-21T05:28:59.553",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "HIGH",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 7.5,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "security@qnapsecurity.com.tw",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-04-17T04:15:11.610",
      "references": [
        {
          "source": "security@qnapsecurity.com.tw",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.qnap.com/en/security-advisory/qsa-21-11"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.qnap.com/en/security-advisory/qsa-21-11"
        }
      ],
      "sourceIdentifier": "security@qnapsecurity.com.tw",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-20"
            },
            {
              "lang": "en",
              "value": "CWE-89"
            },
            {
              "lang": "en",
              "value": "CWE-943"
            }
          ],
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-89"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "49B8CCE7-9635-4E7E-8C06-7928D42EA356",
                    "versionEndExcluding": "4.3.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A8CA5A88-434F-4F66-9374-FF5660D5243E",
                    "versionEndExcluding": "4.3.6",
                    "versionStartIncluding": "4.3.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0095:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D1ADCC83-5D09-4CF6-8C9C-42D440C683F2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0096:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B40C2865-B92A-4BE2-921E-E69731764D28",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0136:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8DA27794-77A9-41B6-8A04-83C39D1892F8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0154:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5C30D1E2-AB9E-4E1D-BC7E-A9698CA2E7F2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DB10F6C0-7CB4-49D2-A1F7-9F3387CD1271",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0188:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4432295E-DDDE-49E6-AA5F-2B2D9749F5B9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0210:*:*:*:*:*:*:*",
                    "matchCriteriaId": "10A901AA-1A4E-4EB0-9CD2-8C377CDFB62B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0229:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E593CFA0-ABF0-4FF6-B2DE-735D68B2DA1D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0238:*:*:*:*:*:*:*",
                    "matchCriteriaId": "60E989F4-5B0F-4F20-A722-5F2E299BAF86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0262:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A91C3567-D5D0-476C-B90A-E1D10DC7F6F7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0299:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5A37D998-D055-4FC6-98A9-FD59A9B7C199",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0351:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D849947-2C72-4665-A32F-3E3167B44FC0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0353:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D6DE1F84-922B-4286-B250-0A882822B15F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0361:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3F112598-8DE0-4267-89ED-2501041EBCD8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0369:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB01E995-E8D2-4F16-B307-A436162E5E94",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0378:*:*:*:*:*:*:*",
                    "matchCriteriaId": "557915A4-6894-454B-A8D8-4897A12FB290",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0396:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D3C12ADD-6091-4F55-A30C-48E54F07CFA9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0404:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6034AF2C-BA1E-41E7-B0F5-191A6DCB7334",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0416:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DA58E847-25D1-48AA-94CB-B4B15B2ACB96",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0418:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A8C4062F-D82B-4193-B225-F5AFC13A16E4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0448:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F46D76D-230D-41AC-B100-0B62B8404378",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0514:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A5AA78A4-00D2-4168-8B48-0A23DD8B3C00",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0546:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4BAA1736-2B5E-4F7B-9DC0-065CF4EF9A60",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0570:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BE14B09E-69EE-479C-B523-D77C36A9D0D2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1931A1D6-C1E6-410A-9F9E-9FD949D42C58",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:*",
                    "matchCriteriaId": "77FFA90F-FDFA-4B73-960F-BEE7A92DB6BA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:*",
                    "matchCriteriaId": "491E9EA6-45FC-4D65-9C4E-AB62095DC861",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:*",
                    "matchCriteriaId": "264B823B-E086-464E-A740-68BFB0AB8650",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A5675D7E-1332-445B-BE5A-0506E765E99A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DC246E80-7A88-4D91-989B-2922C70B1378",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C8D69E0D-84C1-4988-9D73-2D3F511748D0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6F583384-38B8-4BB8-A957-BC6DBC145AEE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3.1432:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D7D05B71-CAF6-416F-BF92-AB4934474F26",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A0E214BD-DC96-4B53-9BE7-8DD8F79B4542",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1AB2488-4D3D-494B-9C93-1AA3C7964644",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6C24D008-D055-4A2C-88D4-85FB6DC45EFE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B64D1A6D-D306-46B8-B345-3D9C38544761",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:*",
                    "matchCriteriaId": "067C0A13-525C-4376-A6CC-0B86F7F92670",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4BAE62E0-5FA0-4B9F-ACCA-9C8C70AC1F2C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B6023A8C-77A8-4B79-ACC6-872E98CA0D29",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CAA72D06-4FE1-4DC3-A96B-2975A4A9AF84",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0CD59BCF-E119-4910-90CE-DCA212D146F5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E8F01168-A599-480D-BEB1-FA0195B696E6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:*",
                    "matchCriteriaId": "732218C9-0DD1-4153-BBC4-F9B8DDE03456",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FEE80D8E-69F2-4AEB-85E1-1B4E64234A45",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4CC2FD13-427C-465C-A829-44224537B6D8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15182D24-932E-4CC1-A791-DDFCF8B88C49",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FC7B2F4D-4FB2-4DC2-AE97-C6F3081A9A73",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4EB3E4B8-CF05-4EE2-A0DD-53FD50145893",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:*",
                    "matchCriteriaId": "45C0ADAF-C42E-44EC-96B9-A8EA33AAB67D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6.1446:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E4A24254-768F-4538-9DD8-26DCDEECF7CF",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9AEE9529-C81D-4EC1-A68D-324B2439546C",
                    "versionEndExcluding": "430.1.8.10",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7A76370-2638-4C00-A0BB-42EAC33D2293",
                    "versionEndExcluding": "430.1.8.8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:qnap:multimedia_console:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E40D0A81-501F-4ED6-895A-193B0D93217D",
                    "versionEndExcluding": "1.3.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C0CDD34B-E2E5-40AB-B6BE-C90B65BE7BF1",
                    "versionStartIncluding": "4.4.0",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later"
          },
          {
            "lang": "es",
            "value": "Se ha reportado de una vulnerabilidad de inyecci\u00f3n SQL que afecta al NAS de QNAP que ejecuta Multimedia Console o el add-on Media Streaming. Si se explota, la vulnerabilidad permite a atacantes remotos obtener informaci\u00f3n de la aplicaci\u00f3n.\u0026#xa0;QNAP ya ha corregido esta vulnerabilidad en las siguientes versiones de Multimedia Console y el add-on Media Streaming. QTS versi\u00f3n 4.3.3: add-on Media Streaming versiones 430.1.8.10 y posteriores. QTS versi\u00f3n 4.3.6: add-on Media Streaming versiones 430.1.8.8 y posteriores. QTS versiones 4.4.x y posteriores. Multimedia Console versiones 1.3.4 y posteriores. Tambi\u00e9n hemos corregido esta vulnerabilidad en las siguientes versiones de QTS 4.3.3 y QTS 4.3.6, respectivamente: QTS versi\u00f3n 4.3.3.1624 Build 20210416 o posteriores. QTS versiones 4.3.6.1620 Build 20210322 o posteriores"
          }
        ],
        "id": "CVE-2020-36195",
        "lastModified": "2024-11-21T05:28:59.553",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "security@qnapsecurity.com.tw",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-04-17T04:15:11.610",
        "references": [
          {
            "source": "security@qnapsecurity.com.tw",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.qnap.com/en/security-advisory/qsa-21-11"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.qnap.com/en/security-advisory/qsa-21-11"
          }
        ],
        "sourceIdentifier": "security@qnapsecurity.com.tw",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-89"
              },
              {
                "lang": "en",
                "value": "CWE-943"
              }
            ],
            "source": "security@qnapsecurity.com.tw",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-89"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.