CVE-2018-19953: QNAP NAS File Station Cross-Site Scripting Vulnerability

Q: What is CVE-2018-19953?

CVE-2018-19953 is a cross-site scripting vulnerability in QNAP NAS File Station.

Q: How can the CVE-2018-19953 vulnerability be exploited?

The CVE-2018-19953 vulnerability can be exploited by remote attackers injecting malicious code.

Q: What is the severity level of CVE-2018-19953?

CVE-2018-19953 has a severity level of medium.

Q: Which versions of QTS are affected by CVE-2018-19953?

QTS versions up to 4.4.2.1231, 4.4.1.1201, 4.3.6.1218, and 4.3.4.1190 are affected by CVE-2018-19953.

Q: How can I fix the CVE-2018-19953 vulnerability?

To fix the CVE-2018-19953 vulnerability, update your QTS to version 4.4.2.1231, 4.4.1.1201, 4.3.6.1218, or 4.3.4.1190.

Published Oct 28, 2020

Updated

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Other sources

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

— CISA

Affected Software

13 affected components

QNAP QTS<4.2.6

QNAP QTS>=4.3.1.0013<4.3.3.1161

QNAP QTS>=4.3.4<4.3.4.1190

QNAP QTS>=4.3.6<4.3.6.1218

QNAP QTS>=4.4.0<4.4.1.1201

QNAP QTS>=4.4.2<4.4.2.1231

QNAP QTS=4.2.6

QNAP QTS=4.2.6-build_20170517

QNAP QTS=4.2.6-build_20190322

QNAP QTS=4.2.6-build_20190730

QNAP QTS=4.2.6-build_20190921

QNAP QTS=4.2.6-build_20191107

QNAP Network Attached Storage (NAS)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.4.2.1231
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.4.1.1201
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.3.6.1218
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.3.4.1190
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.3.3.1161
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.2.6

Event History

Oct 28, 2020

CVE Published

via MITRE·05:55 PM

Data Sourced

via MITRE·05:55 PM

DescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

May 24, 2022

Known Exploited

via CISA·12:00 AM

Known Ransomware

via CISA·12:00 AM

Frequently Asked Questions

What is CVE-2018-19953?

CVE-2018-19953 is a cross-site scripting vulnerability in QNAP NAS File Station.

How can the CVE-2018-19953 vulnerability be exploited?