CVE-2020-2505: Sensitive information via generation of error messages vulnerability in QES
Published Dec 24, 2020
·Updated
If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
Affected Software
8 affected components
QNAP QES<2.1.1
QNAP QES=2.1.1
QNAP QES=2.1.1-build_20200211
QNAP QES=2.1.1-build_20200303
QNAP QES=2.1.1-build_20200319
QNAP QES=2.1.1-build_20200424
QNAP QES=2.1.1-build_20200515
QNAP QES=2.1.1-build_20200811
Remediation
Information
QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
Event History
Dec 24, 2020
CVE Published
via MITRE·01:39 AM
Data Sourced
via MITRE·01:39 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-2505?
CVE-2020-2505 is considered a moderate severity vulnerability due to the potential for sensitive information exposure.
2
How do I fix CVE-2020-2505?
To address CVE-2020-2505, upgrade to QES 2.1.1 Build 20201006 or later.
3
Which versions of QES are affected by CVE-2020-2505?
CVE-2020-2505 affects all versions of QES prior to 2.1.1 Build 20201006.
4
What type of information could be exposed due to CVE-2020-2505?
CVE-2020-2505 could potentially expose sensitive information captured in error messages.
5
Is there a workaround for CVE-2020-2505?
There is no known workaround for CVE-2020-2505; patching is required to mitigate the vulnerability.