CVE-2020-2505 (GCVE-0-2020-2505)

Vulnerability from cvelistv5 – Published: 2020-12-24 01:39 – Updated: 2024-09-16 21:07
VLAI?
Summary
If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
Severity ?
2.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-209 - Information Exposure Through an Error Message
  • CWE-755 - Improper Handling of Exceptional Conditions
Assigner
References
Impacted products
Vendor Product Version
QNAP Systems Inc. QES Affected: unspecified , < 2.1.1 (custom)
Create a notification for this product.
Credits
TIM Security Red Team Research
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:54.406Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "build 20201006"
          ],
          "product": "QES",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "2.1.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "TIM Security Red Team Research"
        }
      ],
      "datePublic": "2020-12-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209 Information Exposure Through an Error Message",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-31T16:33:28",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-17"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later."
        }
      ],
      "source": {
        "advisory": "QSA-20-17",
        "discovery": "EXTERNAL"
      },
      "title": "Sensitive information via generation of error messages vulnerability in QES",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2020-12-23T05:49:00.000Z",
          "ID": "CVE-2020-2505",
          "STATE": "PUBLIC",
          "TITLE": "Sensitive information via generation of error messages vulnerability in QES"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QES",
                      "version": {
                        "version_data": [
                          {
                            "platform": "build 20201006",
                            "version_affected": "\u003c",
                            "version_value": "2.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP Systems Inc."
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "TIM Security Red Team Research"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-209 Information Exposure Through an Error Message"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-755 Improper Handling of Exceptional Conditions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-17",
              "refsource": "MISC",
              "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-17"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later."
          }
        ],
        "source": {
          "advisory": "QSA-20-17",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2020-2505",
    "datePublished": "2020-12-24T01:39:48.218705Z",
    "dateReserved": "2019-12-09T00:00:00",
    "dateUpdated": "2024-09-16T21:07:28.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qes:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.1.1\", \"matchCriteriaId\": \"B5DBF31A-5D26-4C7D-8E69-31061FC16C6D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qes:2.1.1:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"B075440F-4DEA-494D-AE27-1182CA4889D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qes:2.1.1:build_20200211:*:*:*:*:*:*\", \"matchCriteriaId\": \"67632014-C383-490C-B048-4DFE88AD3F30\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qes:2.1.1:build_20200303:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF83A348-E7B1-4008-8313-9F28B9A9B020\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qes:2.1.1:build_20200319:*:*:*:*:*:*\", \"matchCriteriaId\": \"AAF45709-BE55-45A4-8DD1-0D3E417D8382\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qes:2.1.1:build_20200424:*:*:*:*:*:*\", \"matchCriteriaId\": \"7C956E79-D019-4AE3-BB65-9A70282CD780\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qes:2.1.1:build_20200515:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB21A827-5B92-468F-9BD0-09EB3E8A2ED4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qes:2.1.1:build_20200811:*:*:*:*:*:*\", \"matchCriteriaId\": \"DA11F0F0-236A-4A24-9AF7-DC8E78D5AA3C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.\"}, {\"lang\": \"es\", \"value\": \"Si se explota, esta vulnerabilidad podr\\u00eda permitir a atacantes obtener informaci\\u00f3n confidencial por medio de la generaci\\u00f3n de mensajes de error.\u0026#xa0;QNAP ya ha corregido estos problemas en QES versiones 2.1.1 Build 20201006 y posteriores\"}]",
      "id": "CVE-2020-2505",
      "lastModified": "2024-11-21T05:25:22.497",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@qnapsecurity.com.tw\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 2.3, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 0.8, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 2.3, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 0.8, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-12-24T02:15:12.750",
      "references": "[{\"url\": \"https://www.qnap.com/zh-tw/security-advisory/qsa-20-17\", \"source\": \"security@qnapsecurity.com.tw\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.qnap.com/zh-tw/security-advisory/qsa-20-17\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@qnapsecurity.com.tw",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@qnapsecurity.com.tw\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-209\"}, {\"lang\": \"en\", \"value\": \"CWE-755\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-209\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-2505\",\"sourceIdentifier\":\"security@qnapsecurity.com.tw\",\"published\":\"2020-12-24T02:15:12.750\",\"lastModified\":\"2024-11-21T05:25:22.497\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.\"},{\"lang\":\"es\",\"value\":\"Si se explota, esta vulnerabilidad podr\u00eda permitir a atacantes obtener informaci\u00f3n confidencial por medio de la generaci\u00f3n de mensajes de error.\u0026#xa0;QNAP ya ha corregido estos problemas en QES versiones 2.1.1 Build 20201006 y posteriores\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.8,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"},{\"lang\":\"en\",\"value\":\"CWE-755\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qes:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.1.1\",\"matchCriteriaId\":\"B5DBF31A-5D26-4C7D-8E69-31061FC16C6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qes:2.1.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B075440F-4DEA-494D-AE27-1182CA4889D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qes:2.1.1:build_20200211:*:*:*:*:*:*\",\"matchCriteriaId\":\"67632014-C383-490C-B048-4DFE88AD3F30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qes:2.1.1:build_20200303:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF83A348-E7B1-4008-8313-9F28B9A9B020\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qes:2.1.1:build_20200319:*:*:*:*:*:*\",\"matchCriteriaId\":\"AAF45709-BE55-45A4-8DD1-0D3E417D8382\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qes:2.1.1:build_20200424:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C956E79-D019-4AE3-BB65-9A70282CD780\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qes:2.1.1:build_20200515:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB21A827-5B92-468F-9BD0-09EB3E8A2ED4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qes:2.1.1:build_20200811:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA11F0F0-236A-4A24-9AF7-DC8E78D5AA3C\"}]}]}],\"references\":[{\"url\":\"https://www.qnap.com/zh-tw/security-advisory/qsa-20-17\",\"source\":\"security@qnapsecurity.com.tw\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.qnap.com/zh-tw/security-advisory/qsa-20-17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.