CVE-2018-19943: QNAP NAS File Station Cross-Site Scripting Vulnerability

Published Oct 28, 2020
·
Updated

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Other sources

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

— CISA

Affected Software

17 affected components
QNAP QTS<4.2.6
QNAP QTS>=4.3.1.0013<4.3.3.1252
QNAP QTS>=4.3.4<4.3.4.1282
QNAP QTS>=4.3.6<4.3.6.1263
QNAP QTS>=4.4.0<4.4.1.1261
QNAP QTS>=4.4.2<4.4.2.1270
QNAP QTS=4.2.6
QNAP QTS=4.2.6-build_20170517
QNAP QTS=4.2.6-build_20190322
QNAP QTS=4.2.6-build_20190730
QNAP QTS=4.2.6-build_20190921
QNAP QTS=4.2.6-build_20191107
QNAP QTS=4.2.6-build_20200109
QNAP QTS=4.2.6-build_20200421
QNAP QTS=4.2.6-build_20200611
QNAP QTS=4.2.6-build_20200821
QNAP Network Attached Storage (NAS)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.

    Fixed in 4.4.2.1270 build 20200410 and later
  2. Upgrade

    Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.

    Fixed in 4.4.1.1261 build 20200330 and later
  3. Upgrade

    Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.

    Fixed in 4.3.6.1263 build 20200330 and later
  4. Upgrade

    Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.

    Fixed in 4.3.4.1282 build 20200408 and later
  5. Upgrade

    Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.

    Fixed in 4.3.3.1252 build 20200409 and later
  6. Upgrade

    Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.

    Fixed in 4.2.6 build 20200421 and later

Event History

Oct 28, 2020
CVE Published
via MITRE·05:55 PM
Data Sourced
via MITRE·05:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
May 24, 2022
Known Exploited
via CISA·12:00 AM
Known Ransomware
via CISA·12:00 AM

Frequently Asked Questions

1

What is CVE-2018-19943?

CVE-2018-19943 is a cross-site scripting vulnerability that affects QNAP NAS File Station.

2

How does the CVE-2018-19943 vulnerability impact my system?

If exploited, the CVE-2018-19943 vulnerability could allow remote attackers to inject malicious code.

3

Which versions of QTS are affected by the CVE-2018-19943 vulnerability?

QNAP has already fixed the CVE-2018-19943 vulnerability in the following QTS versions: QTS 4.4.2.1270 build 20200410 and later, QTS 4.4.1.1261 build 20200330 and later, QTS 4.3.6.1263 build 20200330 and later.

4

How severe is the CVE-2018-19943 vulnerability?

The severity of the CVE-2018-19943 vulnerability is high with a CVSS score of 5.4.

5

How can I fix the CVE-2018-19943 vulnerability?

To fix the CVE-2018-19943 vulnerability, update your QTS to one of the fixed versions provided by QNAP.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203