Detections
Analytics

Qnap QTS Cross-site Scripting (CVE-2021-28806)

medium Tenable OT Security Plugin ID 502616

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503.
This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

See Also

https://www.qnap.com/zh-tw/security-advisory/qsa-21-22

Plugin Details

Severity: Medium

ID: 502616

Version: 1.1

Type: remote

Family: Tenable.ot

Published: 10/16/2024

Updated: 10/16/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Low

Base Score: 3.5

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2021-28806

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vulnerability Information

CPE: cpe:/o:qnap:quts_hero:h4.5.2, cpe:/o:qnap:qts:4.5.3

Required KB Items: Tenable.ot/Qnap

Exploit Ease: No known exploits are available

Patch Publication Date: 6/3/2021

Vulnerability Publication Date: 6/3/2021

Reference Information

CVE: CVE-2021-28806

CWE: 79