CVE-2018-19941

Published: Dec 31, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)

Affected (3)

Products: Qnap: Qts, Quts Hero, Qutscloud

3 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Qnap Qts	Before 4.5.1.1456
Qnap Quts Hero	Before h4.5.1.1472
Qnap Qutscloud	Before c4.5.2.1379

Related CWEs

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Cleartext Storage of Sensitive Information in a Cookie

The product stores sensitive information in cleartext in a cookie.

References (2)

https://www.qnap.com/zh-tw/security-advisory/qsa-20-23

Source: security@qnapsecurity.com.tw

Vendor Advisory

https://www.qnap.com/zh-tw/security-advisory/qsa-20-23

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.