CVE-2023-39300 (GCVE-0-2023-39300)
Vulnerability from cvelistv5
Published
2024-09-06 16:27
Modified
2024-09-06 17:44
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
Summary
An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later
References
Impacted products
Vendor Product Version
QNAP Systems Inc. QTS Version: 4.3.6   < 4.3.6.2805 build 20240619
Version: 4.3.4   < 4.3.4.2814 build 20240618
Version: 4.3.3   < 4.3.3.2784 build 20240619
Version: 4.2.6   < 4.2.6 build 20240618
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "qts",
            "vendor": "qnap",
            "versions": [
              {
                "lessThan": "4.3.6.2805_build_20240619",
                "status": "affected",
                "version": "4.3.6",
                "versionType": "custom"
              },
              {
                "lessThan": "4.3.4.2814_build_20240618",
                "status": "affected",
                "version": "4.3.4",
                "versionType": "custom"
              },
              {
                "lessThan": "4.3.3.2784_build_20240619",
                "status": "affected",
                "version": "4.3.3",
                "versionType": "custom"
              },
              {
                "lessThan": "4.2.6_build_20240618",
                "status": "affected",
                "version": "4.2.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-06T17:35:15.918021Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T17:44:00.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "4.3.6.2805 build 20240619",
              "status": "affected",
              "version": "4.3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.4.2814 build 20240618",
              "status": "affected",
              "version": "4.3.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.3.2784 build 20240619",
              "status": "affected",
              "version": "4.3.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.6 build 20240618",
              "status": "affected",
              "version": "4.2.6",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "5.x"
            },
            {
              "status": "unaffected",
              "version": "4.5.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTS hero",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "h5.x"
            },
            {
              "status": "unaffected",
              "version": "h4.5.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTScloud",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "c5.x"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arseniy Sharoglazov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e"
            }
          ],
          "value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T16:27:04.275Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "url": "https://www.qnap.com/en/security-advisory/qsa-24-26"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
        }
      ],
      "source": {
        "advisory": "QSA-24-26",
        "discovery": "EXTERNAL"
      },
      "title": "QTS",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2023-39300",
    "datePublished": "2024-09-06T16:27:04.275Z",
    "dateReserved": "2023-07-27T06:46:01.477Z",
    "dateUpdated": "2024-09-06T17:44:00.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-39300\",\"sourceIdentifier\":\"security@qnapsecurity.com.tw\",\"published\":\"2024-09-06T17:15:12.070\",\"lastModified\":\"2024-09-24T16:42:02.873\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 4.3.6.2805 build 20240619 and later\\nQTS 4.3.4.2814 build 20240618 and later\\nQTS 4.3.3.2784 build 20240619 and later\\nQTS 4.2.6 build 20240618 and later\"},{\"lang\":\"es\",\"value\":\"Se ha informado de una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo que afecta a la versi\u00f3n anterior de QTS. Si se explota, la vulnerabilidad podr\u00eda permitir que los administradores autenticados ejecuten comandos a trav\u00e9s de una red. Ya hemos corregido la vulnerabilidad en las siguientes versiones: QTS 4.3.6.2805, compilaci\u00f3n 20240619 y posteriores QTS 4.3.4.2814, compilaci\u00f3n 20240618 y posteriores QTS 4.3.3.2784, compilaci\u00f3n 20240619 y posteriores QTS 4.2.6, compilaci\u00f3n 20240618 y posteriores\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:*\",\"matchCriteriaId\":\"C39B0B5B-93CB-4106-AAA3-00E6E61DDC08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C4725E3-30EE-44C6-9666-889EE2A24E39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:*\",\"matchCriteriaId\":\"4217A41D-B8E3-4E42-8583-96A284CA46D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:*\",\"matchCriteriaId\":\"2095D4D4-409D-486A-B389-08645DE2E0CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:*\",\"matchCriteriaId\":\"E49E2317-BBB3-4E52-958A-727E51EC93FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0E448EC-BA27-4271-800A-D7C84958CBE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CF83203-FC41-4EE8-8867-42E8A99C0E05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:*\",\"matchCriteriaId\":\"AED6D211-E440-430C-8DB2-AF4DC5B75199\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD0BC5AB-F6D3-4A57-B186-CA683796D879\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:*\",\"matchCriteriaId\":\"1400CC6C-2C00-43A5-A39C-7FF7A45B4D1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8F0065B-7CE5-4EFF-899A-100086D71B14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:*\",\"matchCriteriaId\":\"63A88B37-B94A-4627-BF0A-69805499F16B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:*\",\"matchCriteriaId\":\"F347765F-1C36-41AA-8414-56FEB66F45C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:*\",\"matchCriteriaId\":\"E22A7A54-3FBD-4FF5-842B-20CDEF56EF37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:*\",\"matchCriteriaId\":\"40551635-979F-4D0A-B8F2-F640073091E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D56EDE7-E16F-4EE6-AD88-0901687F2DAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3816896-A891-45AF-BE47-3D2857DAC541\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F01EA3A-CC9B-406E-8643-6054ABE9AD52\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8AA595A-36CA-490F-B6BD-9D896F58FF2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:*\",\"matchCriteriaId\":\"2214698A-09DB-40F5-ABDA-55CEB759ACFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:*\",\"matchCriteriaId\":\"232782BB-25D4-4BD1-AAF0-22530CE2C82B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:*\",\"matchCriteriaId\":\"B754C198-F85C-401B-995B-D61A73057F5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:*\",\"matchCriteriaId\":\"61CAA378-3236-46B4-8A14-092EFF921073\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:*\",\"matchCriteriaId\":\"63D954BB-F6C4-4C3A-9E71-F34E53B8E764\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:*\",\"matchCriteriaId\":\"E252DEAA-10C0-4A7D-B66A-1C9ABFC042C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8099233-501E-41E8-BBDA-0F5C6BDC0FDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.2441:build_20230621:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5E98E02-D677-4E31-A498-C18E64816F6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.2665:build_20240131:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C41F264-FD5E-481C-BF90-6EEA634E554C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:*\",\"matchCriteriaId\":\"971833DE-934A-4BB5-AA50-E424A3D4EE49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CF7C63D-18EE-4297-980C-72111832DBA9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED6B6071-8D91-466D-80DB-1620CE9202D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:*\",\"matchCriteriaId\":\"71B9DEEF-D85C-46CE-B0D4-902397B8CD96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB07475A-7C40-450F-85BE-D8A8F7434C0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8A4458A-136F-483D-98D4-43568EC4FC0F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26CD586-13C5-4F77-9DC0-3565A3FF7F60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:*\",\"matchCriteriaId\":\"6390A450-25B5-41CC-9866-1AC81ECD0DC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD5F45E0-8DE4-4DF0-AF65-DE8149E2B738\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE252780-1A93-4211-91E3-CE46B26EC2AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2103CD3-4E85-4C08-A73C-EE5392682027\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:*\",\"matchCriteriaId\":\"E21AE5D2-93C8-49AF-A88D-F8C561B76857\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7268137-D207-4294-9CD1-BA776AE9606E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.2451:build_20230621:*:*:*:*:*:*\",\"matchCriteriaId\":\"275EE698-6440-4980-92E3-52479EB08CE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.2675:build_20240131:*:*:*:*:*:*\",\"matchCriteriaId\":\"F86DE576-C9BF-46C4-BFBF-67C34F173B97\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:*\",\"matchCriteriaId\":\"3686F6D2-9F42-489A-B4FF-9CDF127BD2F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:*\",\"matchCriteriaId\":\"08C2B922-0B29-41FA-9FA7-5821713541E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:*\",\"matchCriteriaId\":\"32BFAA90-8807-4D5E-B150-0760F682C6D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F26EEEF-EDCD-4E7F-8F66-FD44B6521663\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:*\",\"matchCriteriaId\":\"81652269-F0DB-4350-8DC0-4CC203C1DF11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1DCFEFF-AB18-4B4E-9B99-9DBDC5AF49CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:*\",\"matchCriteriaId\":\"9951A1AF-4B46-4D9D-B6C5-2BCB15BD070C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AB586D1-CF9F-4C87-B604-6A9DB9657D76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D3650DB-205C-4B13-BDFC-E56172DD4156\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECD41187-A0AF-41E8-A884-E605C6CF7DFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC95BBCC-A0D8-42FB-880F-5155655519C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D84B904-55E9-414A-9CBC-232EADD08E88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FA8C7BD-C123-484A-8317-37AE1C68D110\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0BAF780-8DD3-4AC4-86CF-A2FD903EA171\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:*\",\"matchCriteriaId\":\"F25FEB20-22E9-41B5-B310-21C95D29C604\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:*\",\"matchCriteriaId\":\"82EE2EC6-F5EA-4E6A-B24A-C9D5925B4EA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C735F47-4409-47E9-B616-31BADC64EB5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEC5C7EC-0055-4D83-B700-6BB571139761\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.2420:build_20230621:*:*:*:*:*:*\",\"matchCriteriaId\":\"58ADDC0D-9550-4713-A068-A39D001F84FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.2644:build_20240131:*:*:*:*:*:*\",\"matchCriteriaId\":\"62168CE8-D892-4291-B85B-EA171BBB9074\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F523E9F-D101-4C29-A624-74E1F3F8CB7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*\",\"matchCriteriaId\":\"1388DBE0-F6BB-44AB-81AC-BFB4E70BE820\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF3C4461-C1B6-43A1-BA5E-D6658EFD06EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1F11848-6FED-4D58-A177-36D280C0347C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6259C86-FFDA-40E8-AF0C-33CC8C108DC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E01E157-BDF1-4B00-BA9B-6887C0C7DFF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D1E5368-9587-4E0A-BB65-D88069CA8490\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*\",\"matchCriteriaId\":\"B63CE419-871C-4866-8AB1-4BB6461E1D74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*\",\"matchCriteriaId\":\"886A71D1-9615-47A5-B3C2-CBC6F02961A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B7A506C-1F53-4CEC-9828-9327352DE153\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*\",\"matchCriteriaId\":\"060D81A5-599A-4329-99C8-D69725C65AF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB41EDDB-E185-4E3F-9497-3826A7955BBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:*\",\"matchCriteriaId\":\"86830BEE-D24C-4618-9070-EA968D533096\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FDF9A85-F956-4C2F-80FD-E5D899761A15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:*\",\"matchCriteriaId\":\"F80B7DEF-3EB6-4C48-B0A6-108211B34BFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20240131:*:*:*:*:*:*\",\"matchCriteriaId\":\"4467FB2F-9A18-4211-A251-C4FCDB18CAA5\"}]}]}],\"references\":[{\"url\":\"https://www.qnap.com/en/security-advisory/qsa-24-26\",\"source\":\"security@qnapsecurity.com.tw\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-39300\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-06T17:35:15.918021Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*\"], \"vendor\": \"qnap\", \"product\": \"qts\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.3.6\", \"lessThan\": \"4.3.6.2805_build_20240619\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.4\", \"lessThan\": \"4.3.4.2814_build_20240618\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.3\", \"lessThan\": \"4.3.3.2784_build_20240619\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.6\", \"lessThan\": \"4.2.6_build_20240618\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-06T17:39:21.412Z\"}}], \"cna\": {\"title\": \"QTS\", \"source\": {\"advisory\": \"QSA-24-26\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Arseniy Sharoglazov\"}], \"impacts\": [{\"capecId\": \"CAPEC-88\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-88\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QTS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.3.6\", \"lessThan\": \"4.3.6.2805 build 20240619\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.4\", \"lessThan\": \"4.3.4.2814 build 20240618\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.3\", \"lessThan\": \"4.3.3.2784 build 20240619\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.6\", \"lessThan\": \"4.2.6 build 20240618\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QTS\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.x\"}, {\"status\": \"unaffected\", \"version\": \"4.5.x\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTS hero\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"h5.x\"}, {\"status\": \"unaffected\", \"version\": \"h4.5.x\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTScloud\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"c5.x\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"We have already fixed the vulnerability in the following versions:\\nQTS 4.3.6.2805 build 20240619 and later\\nQTS 4.3.4.2814 build 20240618 and later\\nQTS 4.3.3.2784 build 20240619 and later\\nQTS 4.2.6 build 20240618 and later\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-24-26\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 4.3.6.2805 build 20240619 and later\\nQTS 4.3.4.2814 build 20240618 and later\\nQTS 4.3.3.2784 build 20240619 and later\\nQTS 4.2.6 build 20240618 and later\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78\"}]}], \"providerMetadata\": {\"orgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"shortName\": \"qnap\", \"dateUpdated\": \"2024-09-06T16:27:04.275Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-39300\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-06T17:44:00.200Z\", \"dateReserved\": \"2023-07-27T06:46:01.477Z\", \"assignerOrgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"datePublished\": \"2024-09-06T16:27:04.275Z\", \"assignerShortName\": \"qnap\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.