CVE-2018-19941: Cleartext Storage of Sensitive Information in Cookies

Q: What is CVE-2018-19941?

CVE-2018-19941 is a vulnerability that affects QNAP NAS, allowing an attacker to access sensitive information stored in cleartext inside cookies.

Q: How does CVE-2018-19941 affect QNAP NAS?

This vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools.

Q: What is the severity of CVE-2018-19941?

CVE-2018-19941 has a severity score of 7.5 which is considered high.

Q: Which versions of QNAP NAS are affected by CVE-2018-19941?

QTS versions up to 4.5.1.1456, Quts Hero versions up to h4.5.1.1472, and Qutscloud versions up to c4.5.2.1379 are affected.

Q: Has QNAP fixed CVE-2018-19941?

Yes, QNAP has already fixed this vulnerability in QTS 4.5.1.1456 build and later versions.

Published Dec 31, 2020

Updated

A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)

Affected Software

3 affected components

QNAP QTS<4.5.1.1456

QNAP QuTS hero<h4.5.1.1472

QNAP QuTScloud<c4.5.2.1379

Remediation

Information

QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)

Event History

Dec 31, 2020

CVE Published

via MITRE·04:33 PM

Data Sourced

via MITRE·04:33 PM

RemedyDescriptionWeakness

Frequently Asked Questions

What is CVE-2018-19941?

CVE-2018-19941 is a vulnerability that affects QNAP NAS, allowing an attacker to access sensitive information stored in cleartext inside cookies.

How does CVE-2018-19941 affect QNAP NAS?