CVE-2019-7195: QNAP Photo Station Path Traversal Vulnerability
First published: Thu Dec 05 2019(Updated: )
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Credit: security@qnapsecurity.com.tw security@qnapsecurity.com.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| QNAP Photo Station | <6.0.3 | |
| QNAP QTS | =4.4.1 | |
| QNAP Photo Station | <5.7.10 | |
| QNAP QTS | >=4.3.4<=4.4.0 | |
| QNAP Photo Station | <5.4.9 | |
| QNAP QTS | >=4.3.0<=4.3.3 | |
| QNAP Photo Station | <5.2.11 | |
| QNAP QTS | =4.2.6 | |
| QNAP Photo Station | ||
| All of | ||
| QNAP Photo Station | <6.0.3 | |
| QNAP QTS | =4.4.1 | |
| All of | ||
| QNAP Photo Station | <5.7.10 | |
| QNAP QTS | >=4.3.4<=4.4.0 | |
| All of | ||
| QNAP Photo Station | <5.4.9 | |
| QNAP QTS | >=4.3.0<=4.3.3 | |
| All of | ||
| QNAP Photo Station | <5.2.11 | |
| QNAP QTS | =4.2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-7195?
CVE-2019-7195 is the QNAP Photo Station Path Traversal Vulnerability, which allows remote attackers to access or modify system files.
How can I fix CVE-2019-7195?
To fix CVE-2019-7195, QNAP recommends updating Photo Station to their latest version.
What is the severity of CVE-2019-7195?
The severity of CVE-2019-7195 is critical, with a CVSS score of 9.8.
Which software versions are affected by CVE-2019-7195?
QNAP Photo Station versions up to 6.0.3 are affected by CVE-2019-7195.
Are QNAP QTS versions vulnerable to CVE-2019-7195?
No, QNAP QTS versions 4.4.1 and above are not vulnerable to CVE-2019-7195.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/description
- agent/severity
- agent/weakness
- agent/title
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/event
- agent/tags
- collector/nvd-cve
- source/NVD
- vendor/qnap
- canonical/qnap photo station
- canonical/qnap qts
- version/qnap qts/4.4.1
- version/qnap qts/4.3.4
- version/qnap qts/4.4.0
- version/qnap qts/4.3.0
- version/qnap qts/4.3.3
- version/qnap qts/4.2.6