Absolute path traversal vulnerability in QES (QNAP Systems Inc. QES)
En bref
- Source
- NVD
- EPSS
- EPSS 1.03 % · centile 64 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- qnap
- Statut NVD
- Modified
Description
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
- CWE-73 — External Control of File Name or Path
- CWE-20 — Validation d'entrée incorrecte
- CWE-284 — Contrôle d'accès incorrect
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N | qnap |
| CVSS 3.1 | MEDIUM 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N | NVD · security@qnapsecurity.com.tw (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2020-22297
- GCVE · GCVE-0-2020-2504
Avis du CERT-FR
- CERTFR-2020-AVI-844 — Multiples vulnérabilités dans les produits Qnap · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:qnap:qes:*:*:*:*:*:*:*:*< 2.1.1cpe:2.3:a:qnap:qes:2.1.1:-:*:*:*:*:*:*cpe:2.3:a:qnap:qes:2.1.1:build_20200211:*:*:*:*:*:*cpe:2.3:a:qnap:qes:2.1.1:build_20200303:*:*:*:*:*:*cpe:2.3:a:qnap:qes:2.1.1:build_20200319:*:*:*:*:*:*cpe:2.3:a:qnap:qes:2.1.1:build_20200424:*:*:*:*:*:*cpe:2.3:a:qnap:qes:2.1.1:build_20200515:*:*:*:*:*:*cpe:2.3:a:qnap:qes:2.1.1:build_20200811:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| QNAP Systems Inc. · QES | affected unspecified < 2.1.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |