CVE-2018-19953

KEV
Published: Ott 28, 2020 Last Modified: Nov 03, 2025
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none
MEDIUM 4,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: none
Integrity: partial
Availability: none

Description

AI Translation Available

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,3152
Percentile
1,0th
Updated

EPSS Score Trend (Last 90 Days)

79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Confidentiality Integrity Availability
Potential Impacts:
Bypass Protection Mechanism Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: AI/ML, Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 4.2.6
cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version Range Affected
From 4.3.4 (inclusive)
To 4.3.4.1190 (exclusive)
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 4.2.6
cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version Range Affected
To 4.2.6 (exclusive)
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version Range Affected
From 4.3.6 (inclusive)
To 4.3.6.1218 (exclusive)
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version Range Affected
From 4.4.2 (inclusive)
To 4.4.2.1231 (exclusive)
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 4.2.6
cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 4.2.6
cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 4.2.6
cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version Range Affected
From 4.3.1.0013 (inclusive)
To 4.3.3.1161 (exclusive)
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 4.2.6
cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version Range Affected
From 4.4.0 (inclusive)
To 4.4.1.1201 (exclusive)
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalo…
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018…
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01