fkie_cve-2023-32967
Vulnerability from fkie_nvd
Published
2024-02-02 16:15
Modified
2024-11-21 08:04
Severity ?
5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. QTS 5.x, QuTS hero are not affected. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 4.5.4.2627 build 20231225 and later
References
security@qnapsecurity.com.twhttps://www.qnap.com/en/security-advisory/qsa-24-01Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.qnap.com/en/security-advisory/qsa-24-01Vendor Advisory
Impacted products
Vendor Product Version
qnap qts 4.5.4.1715
qnap qts 4.5.4.1723
qnap qts 4.5.4.1741
qnap qts 4.5.4.1787
qnap qts 4.5.4.1800
qnap qts 4.5.4.1892
qnap qts 4.5.4.1931
qnap qts 4.5.4.2012
qnap qts 4.5.4.2117
qnap qts 4.5.4.2280
qnap qts 4.5.4.2374
qnap qts 4.5.4.2627
qnap qutscloud c5.1.0.2498


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:*",
              "matchCriteriaId": "9AA3560E-1778-4278-AD5A-6EB3A63A39A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:*",
              "matchCriteriaId": "39E9AF51-0254-472F-B31F-6ADF1848CBD6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:*",
              "matchCriteriaId": "FBB29CD6-B6BC-4C3E-AD44-8D822D10093C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:*",
              "matchCriteriaId": "A7B98F82-9246-496F-8B15-6F320F8E921F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:*",
              "matchCriteriaId": "AE7D1FD6-7D8D-4884-AE7B-5C0BC4E39F69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:*",
              "matchCriteriaId": "1692CA79-1C6D-4BF8-B49E-3539FCE3E165",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:*",
              "matchCriteriaId": "C15A236A-4C43-4489-B6F3-EBC9AD786F77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:*",
              "matchCriteriaId": "ECE79BCD-8F86-46B1-A3C1-AC503DE1876F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:*",
              "matchCriteriaId": "8303B319-7EA7-42BC-9246-6EBF81DE4545",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:*",
              "matchCriteriaId": "5E0F4CCC-F4A5-407D-BA2E-2BBCBA6B731A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.2374:build_20230416:*:*:*:*:*:*",
              "matchCriteriaId": "4D3AE695-CEEB-4A0C-A751-9172781B776B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.4.2627:-:*:*:*:*:*:*",
              "matchCriteriaId": "320AEB7E-E07B-42AE-8F71-795A516BA5EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:qnap:qutscloud:c5.1.0.2498:build_20230822:*:*:*:*:*:*",
              "matchCriteriaId": "C50B05E2-8F25-4CA7-84FE-F5C510C83FE1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.\nQTS 5.x, QuTS hero are not affected.\n\nWe have already fixed the vulnerability in the following versions:\nQuTScloud c5.1.5.2651 and later\nQTS 4.5.4.2627 build 20231225 and later\n"
    },
    {
      "lang": "es",
      "value": "Se ha informado que una vulnerabilidad de autorizaci\u00f3n incorrecta afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los usuarios autenticados eludir las restricciones de acceso previstas a trav\u00e9s de una red. QTS 5.x y QuTS hero no se ven afectados. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QuTScloud c5.1.5.2651 y posteriores QTS 4.5.4.2627 build 20231225 y posteriores "
    }
  ],
  "id": "CVE-2023-32967",
  "lastModified": "2024-11-21T08:04:18.523",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-02-02T16:15:46.573",
  "references": [
    {
      "source": "security@qnapsecurity.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/en/security-advisory/qsa-24-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/en/security-advisory/qsa-24-01"
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security@qnapsecurity.com.tw",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.