cve-2023-47218
Vulnerability from cvelistv5
Published
2024-02-13 02:44
Modified
2024-08-02 21:01
Severity ?
EPSS score ?
Summary
QTS, QuTS hero, QuTScloud
References
Impacted products
Vendor | Product | Version | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
▼ | QNAP Systems Inc. | QTS |
Version: 5.1.x < 5.1.5.2645 build 20240116 |
||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T21:01:22.911Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://www.qnap.com/en/security-advisory/qsa-23-57" }, { "tags": [ "x_transferred" ], "url": "https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [ { "lessThan": "5.1.5.2645 build 20240116", "status": "affected", "version": "5.1.x", "versionType": "custom" }, { "status": "unaffected", "version": "4.x" } ] }, { "defaultStatus": "unaffected", "product": "QuTS hero", "vendor": "QNAP Systems Inc.", "versions": [ { "lessThan": "h5.1.5.2647 build 20240118", "status": "affected", "version": "h5.1.x", "versionType": "custom" }, { "status": "unaffected", "version": "h4.x" } ] }, { "defaultStatus": "unaffected", "product": "QuTScloud", "vendor": "QNAP Systems Inc.", "versions": [ { "lessThan": "c5.1.5.2651", "status": "affected", "version": "c5.x", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Stephen Fewer, Principal Security Researcher at Rapid7" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.1.5.2645 build 20240116 and later\u003cbr\u003eQuTS hero h5.1.5.2647 build 20240118 and later\u003cbr\u003eQuTScloud c5.1.5.2651 and later\u003cbr\u003e" } ], "value": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.5.2645 build 20240116 and later\nQuTS hero h5.1.5.2647 build 20240118 and later\nQuTScloud c5.1.5.2651 and later\n" } ], "impacts": [ { "capecId": "CAPEC-88", "descriptions": [ { "lang": "en", "value": "CAPEC-88" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-77", "description": "CWE-77", "lang": "en", "type": "CWE" }, { "cweId": "CWE-78", "description": "CWE-78", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-02-13T02:44:14.677Z", "orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap" }, "references": [ { "url": "https://www.qnap.com/en/security-advisory/qsa-23-57" }, { "url": "https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.1.5.2645 build 20240116 and later\u003cbr\u003eQuTS hero h5.1.5.2647 build 20240118 and later\u003cbr\u003eQuTScloud c5.1.5.2651 and later\u003cbr\u003e" } ], "value": "We have already fixed the vulnerability in the following versions:\nQTS 5.1.5.2645 build 20240116 and later\nQuTS hero h5.1.5.2647 build 20240118 and later\nQuTScloud c5.1.5.2651 and later\n" } ], "source": { "advisory": "QSA-23-57", "discovery": "EXTERNAL" }, "title": "QTS, QuTS hero, QuTScloud", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "assignerShortName": "qnap", "cveId": "CVE-2023-47218", "datePublished": "2024-02-13T02:44:14.677Z", "dateReserved": "2023-11-03T09:47:36.053Z", "dateUpdated": "2024-08-02T21:01:22.911Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-47218\",\"sourceIdentifier\":\"security@qnapsecurity.com.tw\",\"published\":\"2024-02-13T03:15:07.700\",\"lastModified\":\"2024-11-21T08:29:58.670\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 5.1.5.2645 build 20240116 and later\\nQuTS hero h5.1.5.2647 build 20240118 and later\\nQuTScloud c5.1.5.2651 and later\\n\"},{\"lang\":\"es\",\"value\":\"Se ha informado que una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los usuarios ejecutar comandos a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.5.2645 compilaci\u00f3n 20240116 y posteriores QuTS hero h5.1.5.2647 compilaci\u00f3n 20240118 y posteriores QuTScloud c5.1.5.2651 y posteriores\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.6,\"impactScore\":3.7}]},\"weaknesses\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"},{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://www.qnap.com/en/security-advisory/qsa-23-57\",\"source\":\"security@qnapsecurity.com.tw\"},{\"url\":\"https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/\",\"source\":\"security@qnapsecurity.com.tw\"},{\"url\":\"https://www.qnap.com/en/security-advisory/qsa-23-57\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.