CVE-2017-7631: XSS
Published Mar 27, 2018
·Updated
Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML.
Affected Software
2 affected components
QNAP QTS=4.2.6
QNAP QTS=4.3.3
Event History
Mar 27, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-7631?
CVE-2017-7631 is considered a high severity vulnerability due to its potential for exploitation via cross-site scripting.
2
How do I fix CVE-2017-7631?
To fix CVE-2017-7631, update your QNAP device to the latest version of QTS beyond 4.3.3.
3
Which versions of QTS are affected by CVE-2017-7631?
CVE-2017-7631 affects QNAP QTS versions 4.2.6 and 4.3.3 build 20170727 and earlier.
4
What type of attacks can CVE-2017-7631 enable?
CVE-2017-7631 can enable remote attackers to inject arbitrary web scripts or HTML into share links.
5
Is there a workaround for CVE-2017-7631 if I cannot update immediately?
As a temporary measure, you can limit access to the File Station and disable sharing links until the vulnerability is patched.