cvelistv5 - cve-2021-28799

CVE-2021-28799 (GCVE-0-2021-28799)

Vulnerability from cvelistv5

Published

2021-05-13 02:55

Modified

2025-10-21 23:25

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-285 - Improper Authorization

Summary

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

References

URL

Tags

security@qnapsecurity.com.tw	https://www.qnap.com/en/security-advisory/QSA-21-13	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.qnap.com/en/security-advisory/QSA-21-13	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799	US Government Resource

Impacted products

Vendor

Product

Version

QNAP Systems Inc.

HBS 3

Version: unspecified < v16.0.0415

QNAP Systems Inc.	HBS 3	Version: unspecified < v3.0.210412
QNAP Systems Inc.	HBS 3	Version: unspecified < v3.0.210411
QNAP Systems Inc.	HBS 3	Version: unspecified < v3.0.210411
QNAP Systems Inc.	HBS 3	Version: unspecified < v16.0.0419
QNAP Systems Inc.	HBS 3	Version: unspecified < v16.0.0419
QNAP Systems Inc.	HBS 2
QNAP Systems Inc.	HBS 1.3

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2022-03-31

Due date: 2022-04-21

Required action: Apply updates per vendor instructions.

Used in ransomware: Known

Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-28799

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:55:11.685Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-28799",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T14:53:29.275519Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-03-31",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:45.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-03-31T00:00:00+00:00",
            "value": "CVE-2021-28799 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "QTS 4.5.2"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0415",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.6"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210412",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.4"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210411",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.3"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210411",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QuTS hero h4.5.1"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0419",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QuTScloud c4.5.1~c4.5.4"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0419",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "HBS 2",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "all versions"
            }
          ]
        },
        {
          "product": "HBS 1.3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "all versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ZUSO ART"
        }
      ],
      "datePublic": "2021-04-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-13T02:55:13.000Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"
        }
      ],
      "source": {
        "advisory": "QSA-21-13",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2021-04-22T00:54:00.000Z",
          "ID": "CVE-2021-28799",
          "STATE": "PUBLIC",
          "TITLE": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HBS 3",
                      "version": {
                        "version_data": [
                          {
                            "platform": "QTS 4.5.2",
                            "version_affected": "\u003c",
                            "version_value": "v16.0.0415"
                          },
                          {
                            "platform": "QTS 4.3.6",
                            "version_affected": "\u003c",
                            "version_value": "v3.0.210412"
                          },
                          {
                            "platform": "QTS 4.3.4",
                            "version_affected": "\u003c",
                            "version_value": "v3.0.210411"
                          },
                          {
                            "platform": "QTS 4.3.3",
                            "version_affected": "\u003c",
                            "version_value": "v3.0.210411"
                          },
                          {
                            "platform": "QuTS hero h4.5.1",
                            "version_affected": "\u003c",
                            "version_value": "v16.0.0419"
                          },
                          {
                            "platform": "QuTScloud c4.5.1~c4.5.4",
                            "version_affected": "\u003c",
                            "version_value": "v16.0.0419"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HBS 2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!",
                            "version_value": "all versions"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HBS 1.3",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!",
                            "version_value": "all versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP Systems Inc."
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "ZUSO ART"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/en/security-advisory/QSA-21-13",
              "refsource": "MISC",
              "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"
          }
        ],
        "source": {
          "advisory": "QSA-21-13",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2021-28799",
    "datePublished": "2021-05-13T02:55:13.827Z",
    "dateReserved": "2021-03-18T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:45.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2021-28799",
      "cwes": "[\"CWE-285\"]",
      "dateAdded": "2022-03-31",
      "dueDate": "2022-04-21",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-28799",
      "product": "Network Attached Storage (NAS)",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.",
      "vendorProject": "QNAP",
      "vulnerabilityName": "QNAP NAS Improper Authorization Vulnerability"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-28799\",\"sourceIdentifier\":\"security@qnapsecurity.com.tw\",\"published\":\"2021-05-13T03:15:06.843\",\"lastModified\":\"2025-11-03T15:07:48.747\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .\"},{\"lang\":\"es\",\"value\":\"Se ha reportado una vulnerabilidad de autorizaci\u00f3n inapropiada que afecta al QNAP NAS que ejecuta HBS versi\u00f3n 3 (Hybrid Backup Sync). Si es explotada, la vulnerabilidad permite a atacantes remotos iniciar sesi\u00f3n en un dispositivo. Este problema afecta a: QNAP Systems Inc. HBS 3 versiones anteriores a v16.0.0415 en QTS versi\u00f3n 4.5.2; versiones anteriores a v3.0.210412 en QTS versi\u00f3n 4.3.6; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.4; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.3; versiones anteriores a 16.0.0419 en QuTS hero versiones h4.5.1; anterior a versi\u00f3n v16.0.0419 en QuTScloud versiones c4.5.1~c4.5.4. Este problema no afecta a: QNAP Systems Inc. HBS versi\u00f3n 2. QNAP Systems Inc. HBS versi\u00f3n 1.3\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"cisaExploitAdd\":\"2022-03-31\",\"cisaActionDue\":\"2022-04-21\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"QNAP NAS Improper Authorization Vulnerability\",\"weaknesses\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.0.0415\",\"matchCriteriaId\":\"A18656F9-AFB4-44BC-AF08-E1A0A5D2EF49\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AC8BD83-EA71-4AF8-AAEC-E46EFCA99EA2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.0.210412\",\"matchCriteriaId\":\"D5920EA4-EEA5-4F64-B06B-EED06E824864\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.0.210411\",\"matchCriteriaId\":\"78491B95-5835-411B-B188-30E496BCB10A\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5994C07-17FE-4784-9FA4-9675BA8B4743\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0C7D2D4-769F-4297-89F4-75366FFA7618\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.0.0419\",\"matchCriteriaId\":\"BB2A5649-4BB9-46E9-8A1A-B6046125BD92\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"548228B3-EB2C-42C1-895B-DA6DC5CA26EE\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.0.0419\",\"matchCriteriaId\":\"BB2A5649-4BB9-46E9-8A1A-B6046125BD92\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"c4.5.1\",\"versionEndIncluding\":\"c4.5.4\",\"matchCriteriaId\":\"FEDF704D-D5AD-45C2-AD7D-E53189C72E1A\"}]}]}],\"references\":[{\"url\":\"https://www.qnap.com/en/security-advisory/QSA-21-13\",\"source\":\"security@qnapsecurity.com.tw\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.qnap.com/en/security-advisory/QSA-21-13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"platforms\": [\"QTS 4.5.2\"], \"product\": \"HBS 3\", \"vendor\": \"QNAP Systems Inc.\", \"versions\": [{\"lessThan\": \"v16.0.0415\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"QTS 4.3.6\"], \"product\": \"HBS 3\", \"vendor\": \"QNAP Systems Inc.\", \"versions\": [{\"lessThan\": \"v3.0.210412\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"QTS 4.3.4\"], \"product\": \"HBS 3\", \"vendor\": \"QNAP Systems Inc.\", \"versions\": [{\"lessThan\": \"v3.0.210411\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"QTS 4.3.3\"], \"product\": \"HBS 3\", \"vendor\": \"QNAP Systems Inc.\", \"versions\": [{\"lessThan\": \"v3.0.210411\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"QuTS hero h4.5.1\"], \"product\": \"HBS 3\", \"vendor\": \"QNAP Systems Inc.\", \"versions\": [{\"lessThan\": \"v16.0.0419\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"QuTScloud c4.5.1~c4.5.4\"], \"product\": \"HBS 3\", \"vendor\": \"QNAP Systems Inc.\", \"versions\": [{\"lessThan\": \"v16.0.0419\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"product\": \"HBS 2\", \"vendor\": \"QNAP Systems Inc.\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"all versions\"}]}, {\"product\": \"HBS 1.3\", \"vendor\": \"QNAP Systems Inc.\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"all versions\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"ZUSO ART\"}], \"datePublic\": \"2021-04-22T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-285\", \"description\": \"CWE-285 Improper Authorization\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2021-05-13T02:55:13.000Z\", \"orgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"shortName\": \"qnap\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.qnap.com/en/security-advisory/QSA-21-13\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"QNAP have already fixed this vulnerability in the following versions of HBS 3:\\nQTS 4.5.2: HBS 3 v16.0.0415 and later\\nQTS 4.3.6: HBS 3 v3.0.210412 and later\\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later\"}], \"source\": {\"advisory\": \"QSA-21-13\", \"discovery\": \"EXTERNAL\"}, \"title\": \"Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)\", \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"security@qnap.com\", \"DATE_PUBLIC\": \"2021-04-22T00:54:00.000Z\", \"ID\": \"CVE-2021-28799\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"HBS 3\", \"version\": {\"version_data\": [{\"platform\": \"QTS 4.5.2\", \"version_affected\": \"\u003c\", \"version_value\": \"v16.0.0415\"}, {\"platform\": \"QTS 4.3.6\", \"version_affected\": \"\u003c\", \"version_value\": \"v3.0.210412\"}, {\"platform\": \"QTS 4.3.4\", \"version_affected\": \"\u003c\", \"version_value\": \"v3.0.210411\"}, {\"platform\": \"QTS 4.3.3\", \"version_affected\": \"\u003c\", \"version_value\": \"v3.0.210411\"}, {\"platform\": \"QuTS hero h4.5.1\", \"version_affected\": \"\u003c\", \"version_value\": \"v16.0.0419\"}, {\"platform\": \"QuTScloud c4.5.1~c4.5.4\", \"version_affected\": \"\u003c\", \"version_value\": \"v16.0.0419\"}]}}, {\"product_name\": \"HBS 2\", \"version\": {\"version_data\": [{\"version_affected\": \"!\", \"version_value\": \"all versions\"}]}}, {\"product_name\": \"HBS 1.3\", \"version\": {\"version_data\": [{\"version_affected\": \"!\", \"version_value\": \"all versions\"}]}}]}, \"vendor_name\": \"QNAP Systems Inc.\"}]}}, \"credit\": [{\"lang\": \"eng\", \"value\": \"ZUSO ART\"}], \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .\"}]}, \"generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"impact\": {\"cvss\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-285 Improper Authorization\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://www.qnap.com/en/security-advisory/QSA-21-13\", \"refsource\": \"MISC\", \"url\": \"https://www.qnap.com/en/security-advisory/QSA-21-13\"}]}, \"solution\": [{\"lang\": \"en\", \"value\": \"QNAP have already fixed this vulnerability in the following versions of HBS 3:\\nQTS 4.5.2: HBS 3 v16.0.0415 and later\\nQTS 4.3.6: HBS 3 v3.0.210412 and later\\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later\"}], \"source\": {\"advisory\": \"QSA-21-13\", \"discovery\": \"EXTERNAL\"}}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T21:55:11.685Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.qnap.com/en/security-advisory/QSA-21-13\"}]}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-28799\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-04T14:53:29.275519Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2022-03-31\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799\"}}}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T14:53:59.832Z\"}, \"timeline\": [{\"time\": \"2022-03-31T00:00:00+00:00\", \"lang\": \"en\", \"value\": \"CVE-2021-28799 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"assignerOrgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"assignerShortName\": \"qnap\", \"cveId\": \"CVE-2021-28799\", \"datePublished\": \"2021-05-13T02:55:13.827Z\", \"dateReserved\": \"2021-03-18T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T19:46:43.847Z\", \"state\": \"PUBLISHED\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

fkie_cve-2021-28799

Vulnerability from fkie_nvd

Published

2021-05-13 03:15

Modified

2025-11-03 15:07

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security@qnapsecurity.com.tw	https://www.qnap.com/en/security-advisory/QSA-21-13	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.qnap.com/en/security-advisory/QSA-21-13	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799	US Government Resource

Impacted products

Vendor	Product	Version
qnap	hybrid_backup_sync	*
qnap	qts	4.5.2
qnap	hybrid_backup_sync	*
qnap	qts	4.3.6
qnap	hybrid_backup_sync	*
qnap	qts	4.3.3
qnap	qts	4.3.4
qnap	hybrid_backup_sync	*
qnap	quts_hero	h4.5.1
qnap	hybrid_backup_sync	*
qnap	qutscloud	*

JSON

To clipboard

{
  "cisaActionDue": "2022-04-21",
  "cisaExploitAdd": "2022-03-31",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "QNAP NAS Improper Authorization Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A18656F9-AFB4-44BC-AF08-E1A0A5D2EF49",
              "versionEndExcluding": "16.0.0415",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AC8BD83-EA71-4AF8-AAEC-E46EFCA99EA2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5920EA4-EEA5-4F64-B06B-EED06E824864",
              "versionEndExcluding": "3.0.210412",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "78491B95-5835-411B-B188-30E496BCB10A",
              "versionEndExcluding": "3.0.210411",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0C7D2D4-769F-4297-89F4-75366FFA7618",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB2A5649-4BB9-46E9-8A1A-B6046125BD92",
              "versionEndExcluding": "16.0.0419",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "548228B3-EB2C-42C1-895B-DA6DC5CA26EE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB2A5649-4BB9-46E9-8A1A-B6046125BD92",
              "versionEndExcluding": "16.0.0419",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEDF704D-D5AD-45C2-AD7D-E53189C72E1A",
              "versionEndIncluding": "c4.5.4",
              "versionStartIncluding": "c4.5.1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
    },
    {
      "lang": "es",
      "value": "Se ha reportado una vulnerabilidad de autorizaci\u00f3n inapropiada que afecta al QNAP NAS que ejecuta HBS versi\u00f3n 3 (Hybrid Backup Sync). Si es explotada, la vulnerabilidad permite a atacantes remotos iniciar sesi\u00f3n en un dispositivo. Este problema afecta a: QNAP Systems Inc. HBS 3 versiones anteriores a v16.0.0415 en QTS versi\u00f3n 4.5.2; versiones anteriores a v3.0.210412 en QTS versi\u00f3n 4.3.6; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.4; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.3; versiones anteriores a 16.0.0419 en QuTS hero versiones h4.5.1; anterior a versi\u00f3n v16.0.0419 en QuTScloud versiones c4.5.1~c4.5.4. Este problema no afecta a: QNAP Systems Inc. HBS versi\u00f3n 2. QNAP Systems Inc. HBS versi\u00f3n 1.3"
    }
  ],
  "id": "CVE-2021-28799",
  "lastModified": "2025-11-03T15:07:48.747",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-05-13T03:15:06.843",
  "references": [
    {
      "source": "security@qnapsecurity.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security@qnapsecurity.com.tw",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

gsd-2021-28799

Vulnerability from gsd

Modified

2023-12-13 01:23

Details

Aliases

CVE-2021-28799

Aliases

CVE-2021-28799

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-28799",
    "description": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .",
    "id": "GSD-2021-28799"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-28799"
      ],
      "details": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .",
      "id": "GSD-2021-28799",
      "modified": "2023-12-13T01:23:29.430684Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cisa.gov": {
      "cveID": "CVE-2021-28799",
      "dateAdded": "2022-03-31",
      "dueDate": "2022-04-21",
      "product": "Network Attached Storage (NAS)",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.",
      "vendorProject": "QNAP",
      "vulnerabilityName": "QNAP NAS Improper Authorization Vulnerability"
    },
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@qnap.com",
        "DATE_PUBLIC": "2021-04-22T00:54:00.000Z",
        "ID": "CVE-2021-28799",
        "STATE": "PUBLIC",
        "TITLE": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "HBS 3",
                    "version": {
                      "version_data": [
                        {
                          "platform": "QTS 4.5.2",
                          "version_affected": "\u003c",
                          "version_value": "v16.0.0415"
                        },
                        {
                          "platform": "QTS 4.3.6",
                          "version_affected": "\u003c",
                          "version_value": "v3.0.210412"
                        },
                        {
                          "platform": "QTS 4.3.4",
                          "version_affected": "\u003c",
                          "version_value": "v3.0.210411"
                        },
                        {
                          "platform": "QTS 4.3.3",
                          "version_affected": "\u003c",
                          "version_value": "v3.0.210411"
                        },
                        {
                          "platform": "QuTS hero h4.5.1",
                          "version_affected": "\u003c",
                          "version_value": "v16.0.0419"
                        },
                        {
                          "platform": "QuTScloud c4.5.1~c4.5.4",
                          "version_affected": "\u003c",
                          "version_value": "v16.0.0419"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "HBS 2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "!",
                          "version_value": "all versions"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "HBS 1.3",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "!",
                          "version_value": "all versions"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "QNAP Systems Inc."
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "ZUSO ART"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-285 Improper Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.qnap.com/en/security-advisory/QSA-21-13",
            "refsource": "MISC",
            "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
          }
        ]
      },
      "solution": [
        {
          "lang": "eng",
          "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"
        }
      ],
      "source": {
        "advisory": "QSA-21-13",
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "16.0.0415",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:qts:4.5.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "3.0.210412",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "3.0.210411",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:qts:4.3.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:qts:4.3.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "16.0.0419",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "16.0.0419",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "c4.5.4",
                    "versionStartIncluding": "c4.5.1",
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "ID": "CVE-2021-28799"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/en/security-advisory/QSA-21-13",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-11-14T19:26Z",
      "publishedDate": "2021-05-13T03:15Z"
    }
  }
}

cnvd-2021-31949

Vulnerability from cnvd

Title

Qnap Systems QNAP HBS 3授权问题漏洞

Description

Qnap Systems QNAP HBS 3是中国威联通（Qnap Systems）公司的一个应用系统。一种全面的数据备份和灾难恢复解决方案。 HBS 3 Hybrid Backup Sync存在授权问题漏洞，该漏洞源于未能充分的授权检查。攻击者可利用该漏洞可以绕过授权检查，直接登录设备。

Severity

高

Patch Name

Qnap Systems QNAP HBS 3授权问题漏洞的补丁

Patch Description

Qnap Systems QNAP HBS 3是中国威联通（Qnap Systems）公司的一个应用系统。一种全面的数据备份和灾难恢复解决方案。 HBS 3 Hybrid Backup Sync存在授权问题漏洞，该漏洞源于未能充分的授权检查。攻击者可利用该漏洞可以绕过授权检查，直接登录设备。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.qnap.com/en/security-advisory/QSA-21-13

Reference

https://www.cybersecurity-help.cz/vdb/SB2021042329

Impacted products

Name
QNAP Systems HBS 3 Hybrid Backup Sync

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-28799"
    }
  },
  "description": "Qnap Systems QNAP HBS 3\u662f\u4e2d\u56fd\u5a01\u8054\u901a\uff08Qnap Systems\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u5e94\u7528\u7cfb\u7edf\u3002\u4e00\u79cd\u5168\u9762\u7684\u6570\u636e\u5907\u4efd\u548c\u707e\u96be\u6062\u590d\u89e3\u51b3\u65b9\u6848\u3002\n\nHBS 3 Hybrid Backup Sync\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u5145\u5206\u7684\u6388\u6743\u68c0\u67e5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u7ed5\u8fc7\u6388\u6743\u68c0\u67e5\uff0c\u76f4\u63a5\u767b\u5f55\u8bbe\u5907\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.qnap.com/en/security-advisory/QSA-21-13",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-31949",
  "openTime": "2021-04-30",
  "patchDescription": "Qnap Systems QNAP HBS 3\u662f\u4e2d\u56fd\u5a01\u8054\u901a\uff08Qnap Systems\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u5e94\u7528\u7cfb\u7edf\u3002\u4e00\u79cd\u5168\u9762\u7684\u6570\u636e\u5907\u4efd\u548c\u707e\u96be\u6062\u590d\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nHBS 3 Hybrid Backup Sync\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u5145\u5206\u7684\u6388\u6743\u68c0\u67e5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u7ed5\u8fc7\u6388\u6743\u68c0\u67e5\uff0c\u76f4\u63a5\u767b\u5f55\u8bbe\u5907\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Qnap Systems QNAP HBS 3\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "QNAP Systems HBS 3 Hybrid Backup Sync"
  },
  "referenceLink": "https://www.cybersecurity-help.cz/vdb/SB2021042329",
  "serverity": "\u9ad8",
  "submitTime": "2021-04-26",
  "title": "Qnap Systems QNAP HBS 3\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

ghsa-4v9x-j7pr-8wxq

Vulnerability from github

Published

2022-05-24 19:02

Modified

2025-10-22 00:32

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-28799"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-13T03:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .",
  "id": "GHSA-4v9x-j7pr-8wxq",
  "modified": "2025-10-22T00:32:13Z",
  "published": "2022-05-24T19:02:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28799"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
    },
    {
      "type": "WEB",
      "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CERTFR-2021-AVI-307

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans QNAP HBS 3 Hybrid Backup Sync. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Qnap	Hybrid Backup Sync	HBS 3 Hybrid Backup Sync pour QuTScloud c4.5.x versions antérieures à 16.0.0419
Qnap	Hybrid Backup Sync	HBS 3 Hybrid Backup Sync pour QuTS hero h4.5.1 versions antérieures à 16.0.0419
Qnap	Hybrid Backup Sync	HBS 3 Hybrid Backup Sync pour QTS 4.5.2 versions antérieures à 16.0.0415
Qnap	Hybrid Backup Sync	HBS 3 Hybrid Backup Sync pour QTS 4.3.6 versions antérieures à 3.0.210412

References

Title

Publication Time

Tags

Bulletin de sécurité QNAP QSA-21-13 du 22 avril 2021

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "HBS 3 Hybrid Backup Sync pour QuTScloud c4.5.x versions ant\u00e9rieures \u00e0 16.0.0419",
      "product": {
        "name": "Hybrid Backup Sync",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "HBS 3 Hybrid Backup Sync pour QuTS hero h4.5.1 versions ant\u00e9rieures \u00e0 16.0.0419",
      "product": {
        "name": "Hybrid Backup Sync",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "HBS 3 Hybrid Backup Sync pour QTS 4.5.2 versions ant\u00e9rieures \u00e0 16.0.0415",
      "product": {
        "name": "Hybrid Backup Sync",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "HBS 3 Hybrid Backup Sync pour QTS 4.3.6 versions ant\u00e9rieures \u00e0 3.0.210412",
      "product": {
        "name": "Hybrid Backup Sync",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-28799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28799"
    }
  ],
  "initial_release_date": "2021-04-22T00:00:00",
  "last_revision_date": "2021-04-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-307",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-04-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans QNAP HBS 3 Hybrid Backup Sync.\nElle permet \u00e0 un attaquant de provoquer un contournement de la politique\nde s\u00e9curit\u00e9, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans QNAP HBS 3 Hybrid Backup Sync",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP QSA-21-13 du 22 avril 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-13"
    }
  ]
}

CERTFR-2021-AVI-334

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Qnap QTS. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Qnap	QTS	HBS 3 Hybrid Backup Sync pour QTS 4.3.4 versions antérieures à 3.0.210411
Qnap	QTS	HBS 3 Hybrid Backup Sync pour QTS 4.3.6 versions antérieures à 3.0.210412
Qnap	QTS	HBS 3 Hybrid Backup Sync pour QTS 4.3.3 versions antérieures à 3.0.210411
Qnap	QTS	HBS 3 Hybrid Backup Sync pour QTS 4.5.2 versions antérieures à 16.0.0415

References

Title

Publication Time

Tags

Bulletin de sécurité Qnap qsa-21-13 du 3 mai 2021

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "HBS 3 Hybrid Backup Sync pour QTS 4.3.4 versions ant\u00e9rieures \u00e0 3.0.210411",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "HBS 3 Hybrid Backup Sync pour QTS 4.3.6 versions ant\u00e9rieures \u00e0 3.0.210412",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "HBS 3 Hybrid Backup Sync pour QTS 4.3.3 versions ant\u00e9rieures \u00e0 3.0.210411",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "HBS 3 Hybrid Backup Sync pour QTS 4.5.2 versions ant\u00e9rieures \u00e0 16.0.0415",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-28799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28799"
    }
  ],
  "initial_release_date": "2021-05-03T00:00:00",
  "last_revision_date": "2021-05-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-334",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-05-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Qnap QTS. Elle permet \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Qnap QTS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap qsa-21-13 du 3 mai 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-13"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2021-28799 (GCVE-0-2021-28799)

Vulnerability from cvelistv5

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

fkie_cve-2021-28799

Vulnerability from fkie_nvd

gsd-2021-28799

Vulnerability from gsd

cnvd-2021-31949

Vulnerability from cnvd

ghsa-4v9x-j7pr-8wxq

Vulnerability from github

CERTFR-2021-AVI-307

Vulnerability from certfr_avis

Solution

CERTFR-2021-AVI-334

Vulnerability from certfr_avis

Solution

Tags

Sightings

Nomenclature