CVE-2021-38677: Reflected XSS Vulnerability in QcalAgent
Published Jan 14, 2022
·Updated
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later
Affected Software
1 affected component
QNAP QcalAgent<1.1.7
Remediation
Information
We have already fixed this vulnerability in the following versions of QcalAgent:
QcalAgent 1.1.7 and later
Event History
Jan 14, 2022
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this cross-site scripting (XSS) vulnerability affecting QNAP device running QcalAgent?
The vulnerability ID is CVE-2021-38677.
2
What is the severity rating of CVE-2021-38677?
The severity rating of CVE-2021-38677 is medium, with a severity value of 6.1.
3
How does this vulnerability impact QNAP device running QcalAgent?
If exploited, this vulnerability allows remote attackers to inject malicious code into the affected device.
4
Which versions of QcalAgent are affected by CVE-2021-38677?
Versions of QcalAgent up to and excluding 1.1.7 are affected by CVE-2021-38677.
5
How can I fix the cross-site scripting (XSS) vulnerability in QNAP device running QcalAgent?
To fix the vulnerability, update QcalAgent to version 1.1.7 or later.