CVE-2021-28805 (GCVE-0-2021-28805)
Vulnerability from cvelistv5 – Published: 2021-06-11 06:35 – Updated: 2024-09-17 04:19
VLAI?
Summary
Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.
Severity ?
7.8 (High)
CWE
- CWE-540 - Information Exposure Through Source Code
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| QNAP Systems Inc. | QSS |
Affected:
unspecified , < 1.0.3 build 20210505
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:11.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-24"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"QSW-M2108-2C"
],
"product": "QSS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 build 20210505",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"QSW-M2108-2S"
],
"product": "QSS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 build 20210505",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"QSW-M2108R-2C"
],
"product": "QSS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 build 20210505",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"QSW-M408"
],
"product": "QSS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "1.0.12 build 20210506",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2021-06-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-540",
"description": "CWE-540 Information Exposure Through Source Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-11T06:35:14",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-24"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP have already fixed this vulnerability in the following versions:\n\nQSW-M2108-2C: QSS 1.0.3 build 20210505 and later\nQSW-M2108-2S: QSS 1.0.3 build 20210505 and later\nQSW-M2108R-2C: QSS 1.0.3 build 20210505 and later\nQSW-M408: QSS 1.0.12 build 20210506 and later"
}
],
"source": {
"advisory": "QSA-21-24",
"discovery": "EXTERNAL"
},
"title": "Inclusion of Sensitive Information in QSS",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2021-06-11T06:01:00.000Z",
"ID": "CVE-2021-28805",
"STATE": "PUBLIC",
"TITLE": "Inclusion of Sensitive Information in QSS"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "QSS",
"version": {
"version_data": [
{
"platform": "QSW-M2108-2C",
"version_affected": "\u003c",
"version_value": "1.0.3 build 20210505"
},
{
"platform": "QSW-M2108-2S",
"version_affected": "\u003c",
"version_value": "1.0.3 build 20210505"
},
{
"platform": "QSW-M2108R-2C",
"version_affected": "\u003c",
"version_value": "1.0.3 build 20210505"
},
{
"platform": "QSW-M408",
"version_affected": "\u003c",
"version_value": "1.0.12 build 20210506"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-540 Information Exposure Through Source Code"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-24",
"refsource": "MISC",
"url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-24"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP have already fixed this vulnerability in the following versions:\n\nQSW-M2108-2C: QSS 1.0.3 build 20210505 and later\nQSW-M2108-2S: QSS 1.0.3 build 20210505 and later\nQSW-M2108R-2C: QSS 1.0.3 build 20210505 and later\nQSW-M408: QSS 1.0.12 build 20210506 and later"
}
],
"source": {
"advisory": "QSA-21-24",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2021-28805",
"datePublished": "2021-06-11T06:35:15.074830Z",
"dateReserved": "2021-03-18T00:00:00",
"dateUpdated": "2024-09-17T04:19:06.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qss:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.0.3\", \"matchCriteriaId\": \"74B6E008-6B5D-48EB-99B4-DB9BC1120F8E\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:qnap:qsw-m2108-2c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A690794E-3F9B-47DA-A365-E8F100C730E2\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:qnap:qsw-m2108-2s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"21692724-A864-4CEB-898C-4E6691C403C1\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:qnap:qsw-m2108r-2c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"37F5E9FC-2CE2-473F-81C1-676BCCFFBD3D\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qnap:qss:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.0.12\", \"matchCriteriaId\": \"4D07C936-1C05-4269-8DC9-9AF534B5177B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:qnap:qsw-m408:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9D7605B1-0C50-4CF5-81A8-61FE897DA748\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.\"}, {\"lang\": \"es\", \"value\": \"Se ha reportado la inclusi\\u00f3n de informaci\\u00f3n confidencial en el c\\u00f3digo fuente que afecta a determinados switches de QNAP que ejecutan QSS. Si es explotada, esta vulnerabilidad permite a atacantes leer datos de la aplicaci\\u00f3n. Este problema afecta: QNAP Systems Inc. QSS versiones anteriores a 1.0.3 build 20210505 en QSW-M2108-2C; versiones anteriores a 1.0.3 build 20210505 en QSW-M2108-2S; versiones anteriores a 1.0.3 build 20210505 en QSW-M2108R-2C; versiones anteriores a 1.0.12 build 20210506 en QSW-M408\"}]",
"id": "CVE-2021-28805",
"lastModified": "2024-11-21T06:00:14.223",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security@qnapsecurity.com.tw\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2021-06-11T07:15:06.593",
"references": "[{\"url\": \"https://www.qnap.com/zh-tw/security-advisory/qsa-21-24\", \"source\": \"security@qnapsecurity.com.tw\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.qnap.com/zh-tw/security-advisory/qsa-21-24\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "security@qnapsecurity.com.tw",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security@qnapsecurity.com.tw\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-540\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-28805\",\"sourceIdentifier\":\"security@qnapsecurity.com.tw\",\"published\":\"2021-06-11T07:15:06.593\",\"lastModified\":\"2024-11-21T06:00:14.223\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.\"},{\"lang\":\"es\",\"value\":\"Se ha reportado la inclusi\u00f3n de informaci\u00f3n confidencial en el c\u00f3digo fuente que afecta a determinados switches de QNAP que ejecutan QSS. Si es explotada, esta vulnerabilidad permite a atacantes leer datos de la aplicaci\u00f3n. Este problema afecta: QNAP Systems Inc. QSS versiones anteriores a 1.0.3 build 20210505 en QSW-M2108-2C; versiones anteriores a 1.0.3 build 20210505 en QSW-M2108-2S; versiones anteriores a 1.0.3 build 20210505 en QSW-M2108R-2C; versiones anteriores a 1.0.12 build 20210506 en QSW-M408\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-540\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qss:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.0.3\",\"matchCriteriaId\":\"74B6E008-6B5D-48EB-99B4-DB9BC1120F8E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:qnap:qsw-m2108-2c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A690794E-3F9B-47DA-A365-E8F100C730E2\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:qnap:qsw-m2108-2s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"21692724-A864-4CEB-898C-4E6691C403C1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:qnap:qsw-m2108r-2c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37F5E9FC-2CE2-473F-81C1-676BCCFFBD3D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qnap:qss:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.0.12\",\"matchCriteriaId\":\"4D07C936-1C05-4269-8DC9-9AF534B5177B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:qnap:qsw-m408:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D7605B1-0C50-4CF5-81A8-61FE897DA748\"}]}]}],\"references\":[{\"url\":\"https://www.qnap.com/zh-tw/security-advisory/qsa-21-24\",\"source\":\"security@qnapsecurity.com.tw\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.qnap.com/zh-tw/security-advisory/qsa-21-24\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…