CVE-2023-32969

Published: Mar 8, 2024Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later

Affected (5)

Products: Qnap: Qts, Quts Hero, Qutscloud

3 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Qnap Qts	From 5.1.0 to 5.1.4.2596
Qnap Qts	Version 5.1.4.2596
Qnap Quts Hero	From h5.1.0 to h5.1.4.2596
Qnap Quts Hero	Version h5.1.4.2596
Qnap Qutscloud	From c5.0.0.1919 to c5.1.5.2651

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.qnap.com/en/security-advisory/qsa-24-11

Source: security@qnapsecurity.com.tw

Vendor Advisory

https://www.qnap.com/en/security-advisory/qsa-24-11

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.