cve-2023-39300
Vulnerability from cvelistv5
Published
2024-09-06 16:27
Modified
2024-09-06 17:44
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later
References
security@qnapsecurity.com.twhttps://www.qnap.com/en/security-advisory/qsa-24-26Vendor Advisory
Impacted products
Vendor Product Version
QNAP Systems Inc. QTS
QNAP Systems Inc. QuTS hero
QNAP Systems Inc. QuTScloud
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "qts",
            "vendor": "qnap",
            "versions": [
              {
                "lessThan": "4.3.6.2805_build_20240619",
                "status": "affected",
                "version": "4.3.6",
                "versionType": "custom"
              },
              {
                "lessThan": "4.3.4.2814_build_20240618",
                "status": "affected",
                "version": "4.3.4",
                "versionType": "custom"
              },
              {
                "lessThan": "4.3.3.2784_build_20240619",
                "status": "affected",
                "version": "4.3.3",
                "versionType": "custom"
              },
              {
                "lessThan": "4.2.6_build_20240618",
                "status": "affected",
                "version": "4.2.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-06T17:35:15.918021Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T17:44:00.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "4.3.6.2805 build 20240619",
              "status": "affected",
              "version": "4.3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.4.2814 build 20240618",
              "status": "affected",
              "version": "4.3.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.3.2784 build 20240619",
              "status": "affected",
              "version": "4.3.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.6 build 20240618",
              "status": "affected",
              "version": "4.2.6",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "5.x"
            },
            {
              "status": "unaffected",
              "version": "4.5.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTS hero",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "h5.x"
            },
            {
              "status": "unaffected",
              "version": "h4.5.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTScloud",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "c5.x"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arseniy Sharoglazov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e"
            }
          ],
          "value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T16:27:04.275Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "url": "https://www.qnap.com/en/security-advisory/qsa-24-26"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
        }
      ],
      "source": {
        "advisory": "QSA-24-26",
        "discovery": "EXTERNAL"
      },
      "title": "QTS",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2023-39300",
    "datePublished": "2024-09-06T16:27:04.275Z",
    "dateReserved": "2023-07-27T06:46:01.477Z",
    "dateUpdated": "2024-09-06T17:44:00.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:*\", \"matchCriteriaId\": \"C39B0B5B-93CB-4106-AAA3-00E6E61DDC08\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C4725E3-30EE-44C6-9666-889EE2A24E39\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:*\", \"matchCriteriaId\": \"4217A41D-B8E3-4E42-8583-96A284CA46D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:*\", \"matchCriteriaId\": \"2095D4D4-409D-486A-B389-08645DE2E0CA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:*\", \"matchCriteriaId\": \"E49E2317-BBB3-4E52-958A-727E51EC93FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0E448EC-BA27-4271-800A-D7C84958CBE2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:*\", \"matchCriteriaId\": \"0CF83203-FC41-4EE8-8867-42E8A99C0E05\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:*\", \"matchCriteriaId\": \"AED6D211-E440-430C-8DB2-AF4DC5B75199\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD0BC5AB-F6D3-4A57-B186-CA683796D879\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:*\", \"matchCriteriaId\": \"1400CC6C-2C00-43A5-A39C-7FF7A45B4D1C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:*\", \"matchCriteriaId\": \"E8F0065B-7CE5-4EFF-899A-100086D71B14\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:*\", \"matchCriteriaId\": \"63A88B37-B94A-4627-BF0A-69805499F16B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:*\", \"matchCriteriaId\": \"F347765F-1C36-41AA-8414-56FEB66F45C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:*\", \"matchCriteriaId\": \"E22A7A54-3FBD-4FF5-842B-20CDEF56EF37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:*\", \"matchCriteriaId\": \"40551635-979F-4D0A-B8F2-F640073091E6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D56EDE7-E16F-4EE6-AD88-0901687F2DAB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:*\", \"matchCriteriaId\": \"D3816896-A891-45AF-BE47-3D2857DAC541\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F01EA3A-CC9B-406E-8643-6054ABE9AD52\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8AA595A-36CA-490F-B6BD-9D896F58FF2A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:*\", \"matchCriteriaId\": \"2214698A-09DB-40F5-ABDA-55CEB759ACFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:*\", \"matchCriteriaId\": \"232782BB-25D4-4BD1-AAF0-22530CE2C82B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:*\", \"matchCriteriaId\": \"B754C198-F85C-401B-995B-D61A73057F5F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:*\", \"matchCriteriaId\": \"61CAA378-3236-46B4-8A14-092EFF921073\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:*\", \"matchCriteriaId\": \"63D954BB-F6C4-4C3A-9E71-F34E53B8E764\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:*\", \"matchCriteriaId\": \"E252DEAA-10C0-4A7D-B66A-1C9ABFC042C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8099233-501E-41E8-BBDA-0F5C6BDC0FDE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.2441:build_20230621:*:*:*:*:*:*\", \"matchCriteriaId\": \"E5E98E02-D677-4E31-A498-C18E64816F6C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.6.2665:build_20240131:*:*:*:*:*:*\", \"matchCriteriaId\": \"7C41F264-FD5E-481C-BF90-6EEA634E554C\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:*\", \"matchCriteriaId\": \"971833DE-934A-4BB5-AA50-E424A3D4EE49\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:*\", \"matchCriteriaId\": \"8CF7C63D-18EE-4297-980C-72111832DBA9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:*\", \"matchCriteriaId\": \"ED6B6071-8D91-466D-80DB-1620CE9202D5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:*\", \"matchCriteriaId\": \"71B9DEEF-D85C-46CE-B0D4-902397B8CD96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB07475A-7C40-450F-85BE-D8A8F7434C0A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8A4458A-136F-483D-98D4-43568EC4FC0F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:*\", \"matchCriteriaId\": \"D26CD586-13C5-4F77-9DC0-3565A3FF7F60\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:*\", \"matchCriteriaId\": \"6390A450-25B5-41CC-9866-1AC81ECD0DC5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD5F45E0-8DE4-4DF0-AF65-DE8149E2B738\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:*\", \"matchCriteriaId\": \"CE252780-1A93-4211-91E3-CE46B26EC2AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:*\", \"matchCriteriaId\": \"C2103CD3-4E85-4C08-A73C-EE5392682027\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:*\", \"matchCriteriaId\": \"E21AE5D2-93C8-49AF-A88D-F8C561B76857\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:*\", \"matchCriteriaId\": \"D7268137-D207-4294-9CD1-BA776AE9606E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.2451:build_20230621:*:*:*:*:*:*\", \"matchCriteriaId\": \"275EE698-6440-4980-92E3-52479EB08CE7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.4.2675:build_20240131:*:*:*:*:*:*\", \"matchCriteriaId\": \"F86DE576-C9BF-46C4-BFBF-67C34F173B97\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:*\", \"matchCriteriaId\": \"3686F6D2-9F42-489A-B4FF-9CDF127BD2F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:*\", \"matchCriteriaId\": \"08C2B922-0B29-41FA-9FA7-5821713541E4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:*\", \"matchCriteriaId\": \"32BFAA90-8807-4D5E-B150-0760F682C6D7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F26EEEF-EDCD-4E7F-8F66-FD44B6521663\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:*\", \"matchCriteriaId\": \"81652269-F0DB-4350-8DC0-4CC203C1DF11\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:*\", \"matchCriteriaId\": \"B1DCFEFF-AB18-4B4E-9B99-9DBDC5AF49CB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:*\", \"matchCriteriaId\": \"9951A1AF-4B46-4D9D-B6C5-2BCB15BD070C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:*\", \"matchCriteriaId\": \"0AB586D1-CF9F-4C87-B604-6A9DB9657D76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D3650DB-205C-4B13-BDFC-E56172DD4156\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:*\", \"matchCriteriaId\": \"ECD41187-A0AF-41E8-A884-E605C6CF7DFE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:*\", \"matchCriteriaId\": \"DC95BBCC-A0D8-42FB-880F-5155655519C3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:*\", \"matchCriteriaId\": \"7D84B904-55E9-414A-9CBC-232EADD08E88\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:*\", \"matchCriteriaId\": \"1FA8C7BD-C123-484A-8317-37AE1C68D110\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:*\", \"matchCriteriaId\": \"C0BAF780-8DD3-4AC4-86CF-A2FD903EA171\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:*\", \"matchCriteriaId\": \"F25FEB20-22E9-41B5-B310-21C95D29C604\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:*\", \"matchCriteriaId\": \"82EE2EC6-F5EA-4E6A-B24A-C9D5925B4EA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:*\", \"matchCriteriaId\": \"2C735F47-4409-47E9-B616-31BADC64EB5E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:*\", \"matchCriteriaId\": \"BEC5C7EC-0055-4D83-B700-6BB571139761\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.2420:build_20230621:*:*:*:*:*:*\", \"matchCriteriaId\": \"58ADDC0D-9550-4713-A068-A39D001F84FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.3.3.2644:build_20240131:*:*:*:*:*:*\", \"matchCriteriaId\": \"62168CE8-D892-4291-B85B-EA171BBB9074\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*\", \"matchCriteriaId\": \"8F523E9F-D101-4C29-A624-74E1F3F8CB7D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*\", \"matchCriteriaId\": \"1388DBE0-F6BB-44AB-81AC-BFB4E70BE820\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF3C4461-C1B6-43A1-BA5E-D6658EFD06EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1F11848-6FED-4D58-A177-36D280C0347C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*\", \"matchCriteriaId\": \"F6259C86-FFDA-40E8-AF0C-33CC8C108DC9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*\", \"matchCriteriaId\": \"9E01E157-BDF1-4B00-BA9B-6887C0C7DFF2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D1E5368-9587-4E0A-BB65-D88069CA8490\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*\", \"matchCriteriaId\": \"B63CE419-871C-4866-8AB1-4BB6461E1D74\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*\", \"matchCriteriaId\": \"886A71D1-9615-47A5-B3C2-CBC6F02961A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*\", \"matchCriteriaId\": \"9B7A506C-1F53-4CEC-9828-9327352DE153\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*\", \"matchCriteriaId\": \"060D81A5-599A-4329-99C8-D69725C65AF3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB41EDDB-E185-4E3F-9497-3826A7955BBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:*\", \"matchCriteriaId\": \"86830BEE-D24C-4618-9070-EA968D533096\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:*\", \"matchCriteriaId\": \"5FDF9A85-F956-4C2F-80FD-E5D899761A15\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:*\", \"matchCriteriaId\": \"F80B7DEF-3EB6-4C48-B0A6-108211B34BFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:qnap:qts:4.2.6:build_20240131:*:*:*:*:*:*\", \"matchCriteriaId\": \"4467FB2F-9A18-4211-A251-C4FCDB18CAA5\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 4.3.6.2805 build 20240619 and later\\nQTS 4.3.4.2814 build 20240618 and later\\nQTS 4.3.3.2784 build 20240619 and later\\nQTS 4.2.6 build 20240618 and later\"}, {\"lang\": \"es\", \"value\": \"Se ha informado de una vulnerabilidad de inyecci\\u00f3n de comandos del sistema operativo que afecta a la versi\\u00f3n anterior de QTS. Si se explota, la vulnerabilidad podr\\u00eda permitir que los administradores autenticados ejecuten comandos a trav\\u00e9s de una red. Ya hemos corregido la vulnerabilidad en las siguientes versiones: QTS 4.3.6.2805, compilaci\\u00f3n 20240619 y posteriores QTS 4.3.4.2814, compilaci\\u00f3n 20240618 y posteriores QTS 4.3.3.2784, compilaci\\u00f3n 20240619 y posteriores QTS 4.2.6, compilaci\\u00f3n 20240618 y posteriores\"}]",
      "id": "CVE-2023-39300",
      "lastModified": "2024-09-24T16:42:02.873",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@qnapsecurity.com.tw\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}]}",
      "published": "2024-09-06T17:15:12.070",
      "references": "[{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-24-26\", \"source\": \"security@qnapsecurity.com.tw\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@qnapsecurity.com.tw",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"security@qnapsecurity.com.tw\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-39300\",\"sourceIdentifier\":\"security@qnapsecurity.com.tw\",\"published\":\"2024-09-06T17:15:12.070\",\"lastModified\":\"2024-09-24T16:42:02.873\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 4.3.6.2805 build 20240619 and later\\nQTS 4.3.4.2814 build 20240618 and later\\nQTS 4.3.3.2784 build 20240619 and later\\nQTS 4.2.6 build 20240618 and later\"},{\"lang\":\"es\",\"value\":\"Se ha informado de una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo que afecta a la versi\u00f3n anterior de QTS. Si se explota, la vulnerabilidad podr\u00eda permitir que los administradores autenticados ejecuten comandos a trav\u00e9s de una red. Ya hemos corregido la vulnerabilidad en las siguientes versiones: QTS 4.3.6.2805, compilaci\u00f3n 20240619 y posteriores QTS 4.3.4.2814, compilaci\u00f3n 20240618 y posteriores QTS 4.3.3.2784, compilaci\u00f3n 20240619 y posteriores QTS 4.2.6, compilaci\u00f3n 20240618 y posteriores\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:*\",\"matchCriteriaId\":\"C39B0B5B-93CB-4106-AAA3-00E6E61DDC08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C4725E3-30EE-44C6-9666-889EE2A24E39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:*\",\"matchCriteriaId\":\"4217A41D-B8E3-4E42-8583-96A284CA46D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:*\",\"matchCriteriaId\":\"2095D4D4-409D-486A-B389-08645DE2E0CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:*\",\"matchCriteriaId\":\"E49E2317-BBB3-4E52-958A-727E51EC93FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0E448EC-BA27-4271-800A-D7C84958CBE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CF83203-FC41-4EE8-8867-42E8A99C0E05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:*\",\"matchCriteriaId\":\"AED6D211-E440-430C-8DB2-AF4DC5B75199\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD0BC5AB-F6D3-4A57-B186-CA683796D879\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:*\",\"matchCriteriaId\":\"1400CC6C-2C00-43A5-A39C-7FF7A45B4D1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8F0065B-7CE5-4EFF-899A-100086D71B14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:*\",\"matchCriteriaId\":\"63A88B37-B94A-4627-BF0A-69805499F16B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:*\",\"matchCriteriaId\":\"F347765F-1C36-41AA-8414-56FEB66F45C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:*\",\"matchCriteriaId\":\"E22A7A54-3FBD-4FF5-842B-20CDEF56EF37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:*\",\"matchCriteriaId\":\"40551635-979F-4D0A-B8F2-F640073091E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D56EDE7-E16F-4EE6-AD88-0901687F2DAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3816896-A891-45AF-BE47-3D2857DAC541\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F01EA3A-CC9B-406E-8643-6054ABE9AD52\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8AA595A-36CA-490F-B6BD-9D896F58FF2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:*\",\"matchCriteriaId\":\"2214698A-09DB-40F5-ABDA-55CEB759ACFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:*\",\"matchCriteriaId\":\"232782BB-25D4-4BD1-AAF0-22530CE2C82B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:*\",\"matchCriteriaId\":\"B754C198-F85C-401B-995B-D61A73057F5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:*\",\"matchCriteriaId\":\"61CAA378-3236-46B4-8A14-092EFF921073\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:*\",\"matchCriteriaId\":\"63D954BB-F6C4-4C3A-9E71-F34E53B8E764\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:*\",\"matchCriteriaId\":\"E252DEAA-10C0-4A7D-B66A-1C9ABFC042C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8099233-501E-41E8-BBDA-0F5C6BDC0FDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.2441:build_20230621:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5E98E02-D677-4E31-A498-C18E64816F6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.6.2665:build_20240131:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C41F264-FD5E-481C-BF90-6EEA634E554C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:*\",\"matchCriteriaId\":\"971833DE-934A-4BB5-AA50-E424A3D4EE49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CF7C63D-18EE-4297-980C-72111832DBA9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED6B6071-8D91-466D-80DB-1620CE9202D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:*\",\"matchCriteriaId\":\"71B9DEEF-D85C-46CE-B0D4-902397B8CD96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB07475A-7C40-450F-85BE-D8A8F7434C0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8A4458A-136F-483D-98D4-43568EC4FC0F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26CD586-13C5-4F77-9DC0-3565A3FF7F60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:*\",\"matchCriteriaId\":\"6390A450-25B5-41CC-9866-1AC81ECD0DC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD5F45E0-8DE4-4DF0-AF65-DE8149E2B738\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE252780-1A93-4211-91E3-CE46B26EC2AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2103CD3-4E85-4C08-A73C-EE5392682027\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:*\",\"matchCriteriaId\":\"E21AE5D2-93C8-49AF-A88D-F8C561B76857\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7268137-D207-4294-9CD1-BA776AE9606E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.2451:build_20230621:*:*:*:*:*:*\",\"matchCriteriaId\":\"275EE698-6440-4980-92E3-52479EB08CE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.4.2675:build_20240131:*:*:*:*:*:*\",\"matchCriteriaId\":\"F86DE576-C9BF-46C4-BFBF-67C34F173B97\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:*\",\"matchCriteriaId\":\"3686F6D2-9F42-489A-B4FF-9CDF127BD2F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:*\",\"matchCriteriaId\":\"08C2B922-0B29-41FA-9FA7-5821713541E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:*\",\"matchCriteriaId\":\"32BFAA90-8807-4D5E-B150-0760F682C6D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F26EEEF-EDCD-4E7F-8F66-FD44B6521663\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:*\",\"matchCriteriaId\":\"81652269-F0DB-4350-8DC0-4CC203C1DF11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1DCFEFF-AB18-4B4E-9B99-9DBDC5AF49CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:*\",\"matchCriteriaId\":\"9951A1AF-4B46-4D9D-B6C5-2BCB15BD070C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AB586D1-CF9F-4C87-B604-6A9DB9657D76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D3650DB-205C-4B13-BDFC-E56172DD4156\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECD41187-A0AF-41E8-A884-E605C6CF7DFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC95BBCC-A0D8-42FB-880F-5155655519C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D84B904-55E9-414A-9CBC-232EADD08E88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FA8C7BD-C123-484A-8317-37AE1C68D110\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0BAF780-8DD3-4AC4-86CF-A2FD903EA171\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:*\",\"matchCriteriaId\":\"F25FEB20-22E9-41B5-B310-21C95D29C604\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:*\",\"matchCriteriaId\":\"82EE2EC6-F5EA-4E6A-B24A-C9D5925B4EA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C735F47-4409-47E9-B616-31BADC64EB5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEC5C7EC-0055-4D83-B700-6BB571139761\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.2420:build_20230621:*:*:*:*:*:*\",\"matchCriteriaId\":\"58ADDC0D-9550-4713-A068-A39D001F84FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.3.3.2644:build_20240131:*:*:*:*:*:*\",\"matchCriteriaId\":\"62168CE8-D892-4291-B85B-EA171BBB9074\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F523E9F-D101-4C29-A624-74E1F3F8CB7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*\",\"matchCriteriaId\":\"1388DBE0-F6BB-44AB-81AC-BFB4E70BE820\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF3C4461-C1B6-43A1-BA5E-D6658EFD06EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1F11848-6FED-4D58-A177-36D280C0347C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6259C86-FFDA-40E8-AF0C-33CC8C108DC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E01E157-BDF1-4B00-BA9B-6887C0C7DFF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D1E5368-9587-4E0A-BB65-D88069CA8490\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*\",\"matchCriteriaId\":\"B63CE419-871C-4866-8AB1-4BB6461E1D74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*\",\"matchCriteriaId\":\"886A71D1-9615-47A5-B3C2-CBC6F02961A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B7A506C-1F53-4CEC-9828-9327352DE153\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*\",\"matchCriteriaId\":\"060D81A5-599A-4329-99C8-D69725C65AF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB41EDDB-E185-4E3F-9497-3826A7955BBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:*\",\"matchCriteriaId\":\"86830BEE-D24C-4618-9070-EA968D533096\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FDF9A85-F956-4C2F-80FD-E5D899761A15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:*\",\"matchCriteriaId\":\"F80B7DEF-3EB6-4C48-B0A6-108211B34BFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:4.2.6:build_20240131:*:*:*:*:*:*\",\"matchCriteriaId\":\"4467FB2F-9A18-4211-A251-C4FCDB18CAA5\"}]}]}],\"references\":[{\"url\":\"https://www.qnap.com/en/security-advisory/qsa-24-26\",\"source\":\"security@qnapsecurity.com.tw\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-39300\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-06T17:35:15.918021Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*\"], \"vendor\": \"qnap\", \"product\": \"qts\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.3.6\", \"lessThan\": \"4.3.6.2805_build_20240619\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.4\", \"lessThan\": \"4.3.4.2814_build_20240618\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.3\", \"lessThan\": \"4.3.3.2784_build_20240619\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.6\", \"lessThan\": \"4.2.6_build_20240618\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-06T17:39:21.412Z\"}}], \"cna\": {\"title\": \"QTS\", \"source\": {\"advisory\": \"QSA-24-26\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Arseniy Sharoglazov\"}], \"impacts\": [{\"capecId\": \"CAPEC-88\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-88\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QTS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.3.6\", \"lessThan\": \"4.3.6.2805 build 20240619\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.4\", \"lessThan\": \"4.3.4.2814 build 20240618\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.3\", \"lessThan\": \"4.3.3.2784 build 20240619\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.6\", \"lessThan\": \"4.2.6 build 20240618\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QTS\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.x\"}, {\"status\": \"unaffected\", \"version\": \"4.5.x\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTS hero\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"h5.x\"}, {\"status\": \"unaffected\", \"version\": \"h4.5.x\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTScloud\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"c5.x\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"We have already fixed the vulnerability in the following versions:\\nQTS 4.3.6.2805 build 20240619 and later\\nQTS 4.3.4.2814 build 20240618 and later\\nQTS 4.3.3.2784 build 20240619 and later\\nQTS 4.2.6 build 20240618 and later\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-24-26\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 4.3.6.2805 build 20240619 and later\\nQTS 4.3.4.2814 build 20240618 and later\\nQTS 4.3.3.2784 build 20240619 and later\\nQTS 4.2.6 build 20240618 and later\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78\"}]}], \"providerMetadata\": {\"orgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"shortName\": \"qnap\", \"dateUpdated\": \"2024-09-06T16:27:04.275Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-39300\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-06T17:44:00.200Z\", \"dateReserved\": \"2023-07-27T06:46:01.477Z\", \"assignerOrgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"datePublished\": \"2024-09-06T16:27:04.275Z\", \"assignerShortName\": \"qnap\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.