← Back

CVE-2021-44053

nvd nist
Published: May 5, 2022Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later

Affected (19)

Qnap
3 products
Qts
Quts Hero
Qutscloud
Configuration A
19 vulnerable
Vulnerable SoftwareAffected Versions
Qnap
Qts
From 5.0.0.1716 to 5.0.0.1986
Qts
From 4.3.3.0174 to 4.3.3.1945
Qts
From 4.3.4.0899 to 4.3.4.1976
Qts
From 4.3.6.0895 to 4.3.6.1965
Qts
From 4.4.0.0883 to 4.5.4.1991
Qts
Version 4.2.6 build_20170517
Qts
Version 4.2.6 build_20190322
Qts
Version 4.2.6 build_20190730
Qts
Version 4.2.6 build_20190921
Qts
Version 4.2.6 build_20191107
Qts
Version 4.2.6 build_20200109
Qts
Version 4.2.6 build_20200421
Qts
Version 4.2.6 build_20200611
Qts
Version 4.2.6 build_20200821
Qts
Version 4.2.6 build_20210327
Qts
Version 4.2.6 build_20211215
Qnap
Quts Hero
Before h4.5.4.1771
Quts Hero
From h5.0.0.1772 to h5.0.0.1986
Qutscloud
Before c5.0.1.1998

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: security@qnapsecurity.com.tw
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.