CVE-2023-45028 (GCVE-0-2023-45028)
Vulnerability from cvelistv5 – Published: 2024-02-02 16:05 – Updated: 2024-08-02 20:14
VLAI?
Title
QTS, QuTS hero, QuTScloud
Summary
An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.1.5.2645 build 20240116 and later
QuTS hero h5.1.5.2647 build 20240118 and later
QuTScloud c5.1.5.2651 and later
Severity ?
5.5 (Medium)
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| QNAP Systems Inc. | QTS |
Affected:
5.1.x , < 5.1.5.2645 build 20240116
(custom)
|
||||||||||||
|
||||||||||||||
Credits
Jiaxu Zhao && Bingwei Peng
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-45028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-08T21:52:10.291213Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:19:56.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:14:18.196Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-24-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "5.1.5.2645 build 20240116",
"status": "affected",
"version": "5.1.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "h5.1.5.2647 build 20240118",
"status": "affected",
"version": "h5.1.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTScloud",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "c5.1.5.2651",
"status": "affected",
"version": "c5.x.x",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Jiaxu Zhao \u0026\u0026 Bingwei Peng"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.1.5.2645 build 20240116 and later\u003cbr\u003eQuTS hero h5.1.5.2647 build 20240118 and later\u003cbr\u003eQuTScloud c5.1.5.2651 and later\u003cbr\u003e"
}
],
"value": "An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.5.2645 build 20240116 and later\nQuTS hero h5.1.5.2647 build 20240118 and later\nQuTScloud c5.1.5.2651 and later\n"
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130"
}
]
},
{
"capecId": "CAPEC-227",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-227"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-02T16:05:20.257Z",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"url": "https://www.qnap.com/en/security-advisory/qsa-24-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.1.5.2645 build 20240116 and later\u003cbr\u003eQuTS hero h5.1.5.2647 build 20240118 and later\u003cbr\u003eQuTScloud c5.1.5.2651 and later\u003cbr\u003e"
}
],
"value": "We have already fixed the vulnerability in the following versions:\nQTS 5.1.5.2645 build 20240116 and later\nQuTS hero h5.1.5.2647 build 20240118 and later\nQuTScloud c5.1.5.2651 and later\n"
}
],
"source": {
"advisory": "QSA-24-02",
"discovery": "EXTERNAL"
},
"title": "QTS, QuTS hero, QuTScloud",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2023-45028",
"datePublished": "2024-02-02T16:05:20.257Z",
"dateReserved": "2023-10-03T08:58:08.182Z",
"dateUpdated": "2024-08-02T20:14:18.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:*\", \"matchCriteriaId\": \"39382CBA-EA68-426A-AC07-A9A26E722CAB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:*\", \"matchCriteriaId\": \"BCB37C08-1DF7-4AF4-9BB1-C562E5643B5A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:*\", \"matchCriteriaId\": \"8368130C-F26D-41FE-8D78-B103A23B5327\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:*\", \"matchCriteriaId\": \"3E0EE181-78AF-4C3C-90A4-C69A2DE6E176\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:*\", \"matchCriteriaId\": \"56E3AE06-78DA-4844-ADC1-09A35F1C5B54\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:*\", \"matchCriteriaId\": \"D2AA7A32-0DA8-4417-A23E-C4F563BC7819\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:*\", \"matchCriteriaId\": \"80E7C17C-ED6D-439D-A1F3-1870A3ADA926\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.3.2578:build_20231110:*:*:*:*:*:*\", \"matchCriteriaId\": \"636C2D9C-C837-4FAC-B79D-1CA7A7C1FF3E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.4.2596:build_20231128:*:*:*:*:*:*\", \"matchCriteriaId\": \"866B455B-0266-4990-920B-A06756ED5A61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:5.1.5.2645:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"F39AD4D1-B99D-4724-AF31-A04209C43D1C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:*\", \"matchCriteriaId\": \"6CA398A8-EBDF-4D41-B15E-7B763F885021\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:*\", \"matchCriteriaId\": \"F63A5ED2-ECC2-49A0-BFA9-548E35ACD6C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:*\", \"matchCriteriaId\": \"53387FAC-7BE0-47D7-99BF-2B1F03C17CC3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:*\", \"matchCriteriaId\": \"D4226394-0023-4CD2-BB89-77251BF92FF3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:*\", \"matchCriteriaId\": \"646257F7-D4A4-43B0-91F2-7850338B3CA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.2.2534:build_20230927:*:*:*:*:*:*\", \"matchCriteriaId\": \"88825AE1-B006-4F7F-BD90-D4B1CF1251A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:build_20231110:*:*:*:*:*:*\", \"matchCriteriaId\": \"3F471666-4919-4770-956E-ACE4C55D29DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.4.2596:build_20231128:*:*:*:*:*:*\", \"matchCriteriaId\": \"9573F671-D49E-438A-B72C-DFC390A79093\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A99570F-1F53-4E24-A3B0-F8BA3C5A4363\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qutscloud:c5.1.0.2498:build_20230822:*:*:*:*:*:*\", \"matchCriteriaId\": \"C50B05E2-8F25-4CA7-84FE-F5C510C83FE1\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 5.1.5.2645 build 20240116 and later\\nQuTS hero h5.1.5.2647 build 20240118 and later\\nQuTScloud c5.1.5.2651 and later\\n\"}, {\"lang\": \"es\", \"value\": \"Se ha informado que una vulnerabilidad de consumo de recursos incontrolado afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\\u00eda permitir a los administradores autenticados lanzar un ataque de denegaci\\u00f3n de servicio (DoS) a trav\\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.5.2645 compilaci\\u00f3n 20240116 y posteriores QuTS hero h5.1.5.2647 compilaci\\u00f3n 20240118 y posteriores QuTScloud c5.1.5.2651 y posteriores\"}]",
"id": "CVE-2023-45028",
"lastModified": "2024-11-21T08:26:15.303",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security@qnapsecurity.com.tw\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 3.6}]}",
"published": "2024-02-02T16:15:50.500",
"references": "[{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-24-02\", \"source\": \"security@qnapsecurity.com.tw\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.qnap.com/en/security-advisory/qsa-24-02\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "security@qnapsecurity.com.tw",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security@qnapsecurity.com.tw\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-400\"}, {\"lang\": \"en\", \"value\": \"CWE-770\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-45028\",\"sourceIdentifier\":\"security@qnapsecurity.com.tw\",\"published\":\"2024-02-02T16:15:50.500\",\"lastModified\":\"2024-11-21T08:26:15.303\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 5.1.5.2645 build 20240116 and later\\nQuTS hero h5.1.5.2647 build 20240118 and later\\nQuTScloud c5.1.5.2651 and later\\n\"},{\"lang\":\"es\",\"value\":\"Se ha informado que una vulnerabilidad de consumo de recursos incontrolado afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los administradores autenticados lanzar un ataque de denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.5.2645 compilaci\u00f3n 20240116 y posteriores QuTS hero h5.1.5.2647 compilaci\u00f3n 20240118 y posteriores QuTScloud c5.1.5.2651 y posteriores\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"},{\"lang\":\"en\",\"value\":\"CWE-770\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:*\",\"matchCriteriaId\":\"39382CBA-EA68-426A-AC07-A9A26E722CAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:*\",\"matchCriteriaId\":\"BCB37C08-1DF7-4AF4-9BB1-C562E5643B5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:*\",\"matchCriteriaId\":\"8368130C-F26D-41FE-8D78-B103A23B5327\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E0EE181-78AF-4C3C-90A4-C69A2DE6E176\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:*\",\"matchCriteriaId\":\"56E3AE06-78DA-4844-ADC1-09A35F1C5B54\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2AA7A32-0DA8-4417-A23E-C4F563BC7819\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E7C17C-ED6D-439D-A1F3-1870A3ADA926\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.3.2578:build_20231110:*:*:*:*:*:*\",\"matchCriteriaId\":\"636C2D9C-C837-4FAC-B79D-1CA7A7C1FF3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.4.2596:build_20231128:*:*:*:*:*:*\",\"matchCriteriaId\":\"866B455B-0266-4990-920B-A06756ED5A61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:5.1.5.2645:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F39AD4D1-B99D-4724-AF31-A04209C43D1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CA398A8-EBDF-4D41-B15E-7B763F885021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:*\",\"matchCriteriaId\":\"F63A5ED2-ECC2-49A0-BFA9-548E35ACD6C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:*\",\"matchCriteriaId\":\"53387FAC-7BE0-47D7-99BF-2B1F03C17CC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4226394-0023-4CD2-BB89-77251BF92FF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:*\",\"matchCriteriaId\":\"646257F7-D4A4-43B0-91F2-7850338B3CA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.2.2534:build_20230927:*:*:*:*:*:*\",\"matchCriteriaId\":\"88825AE1-B006-4F7F-BD90-D4B1CF1251A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:build_20231110:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F471666-4919-4770-956E-ACE4C55D29DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.4.2596:build_20231128:*:*:*:*:*:*\",\"matchCriteriaId\":\"9573F671-D49E-438A-B72C-DFC390A79093\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A99570F-1F53-4E24-A3B0-F8BA3C5A4363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qutscloud:c5.1.0.2498:build_20230822:*:*:*:*:*:*\",\"matchCriteriaId\":\"C50B05E2-8F25-4CA7-84FE-F5C510C83FE1\"}]}]}],\"references\":[{\"url\":\"https://www.qnap.com/en/security-advisory/qsa-24-02\",\"source\":\"security@qnapsecurity.com.tw\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.qnap.com/en/security-advisory/qsa-24-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-24-02\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T20:14:18.196Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-45028\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-08T21:52:10.291213Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:10.973Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"QTS, QuTS hero, QuTScloud\", \"source\": {\"advisory\": \"QSA-24-02\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Jiaxu Zhao \u0026\u0026 Bingwei Peng\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130\"}]}, {\"capecId\": \"CAPEC-227\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-227\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QTS\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1.x\", \"lessThan\": \"5.1.5.2645 build 20240116\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTS hero\", \"versions\": [{\"status\": \"affected\", \"version\": \"h5.1.x\", \"lessThan\": \"h5.1.5.2647 build 20240118\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTScloud\", \"versions\": [{\"status\": \"affected\", \"version\": \"c5.x.x\", \"lessThan\": \"c5.1.5.2651\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"We have already fixed the vulnerability in the following versions:\\nQTS 5.1.5.2645 build 20240116 and later\\nQuTS hero h5.1.5.2647 build 20240118 and later\\nQuTScloud c5.1.5.2651 and later\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.1.5.2645 build 20240116 and later\u003cbr\u003eQuTS hero h5.1.5.2647 build 20240118 and later\u003cbr\u003eQuTScloud c5.1.5.2651 and later\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-24-02\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 5.1.5.2645 build 20240116 and later\\nQuTS hero h5.1.5.2647 build 20240118 and later\\nQuTScloud c5.1.5.2651 and later\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.1.5.2645 build 20240116 and later\u003cbr\u003eQuTS hero h5.1.5.2647 build 20240118 and later\u003cbr\u003eQuTScloud c5.1.5.2651 and later\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400\"}, {\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770\"}]}], \"providerMetadata\": {\"orgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"shortName\": \"qnap\", \"dateUpdated\": \"2024-02-02T16:05:20.257Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-45028\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T20:14:18.196Z\", \"dateReserved\": \"2023-10-03T08:58:08.182Z\", \"assignerOrgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"datePublished\": \"2024-02-02T16:05:20.257Z\", \"assignerShortName\": \"qnap\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…