Junglewise Threat Intelligence

CVE-2018-19943: QNAP NAS File Station Cross-Site Scripting Vulnerability

CVE-2018-19943 · Severity: critical · CVSS 8 · Exploited in the wild · Published 2022-05-24

Technologies: QNAP QTS, QNAP Network Attached Storage (NAS). Vendors: QNAP.

Executive brief

A cross-site scripting (XSS) vulnerability in QNAP NAS File Station allows remote attackers to inject malicious code into web pages. The vulnerability requires user interaction and is known to have been exploited in the wild.

Affected products

  • QNAP QTS < 4.4.2.1270 build 20200410
  • QNAP QTS < 4.4.1.1261 build 20200330
  • QNAP QTS < 4.3.6.1263 build 20200330
  • QNAP QTS < 4.3.4.1282 build 20200408
  • QNAP QTS < 4.3.3.1252 build 20200409
  • QNAP QTS < 4.2.6 build 20200421

Timeline

  • 2020-10-28: disclosed: NVD Published Date
  • 2022-05-24: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2020-03-30: patched: Earliest patch build date listed for QTS 4.4.1 and 4.3.6

Related threats