CVE-2021-38680: Reflected XSS in Kazoo Server
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.20 and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID of the reported cross-site scripting (XSS) vulnerability affecting QNAP device running Kazoo Server?
The vulnerability ID is CVE-2021-38680.
What is the severity of CVE-2021-38680?
The severity of CVE-2021-38680 is medium, with a CVSS score of 6.1.
How does CVE-2021-38680 affect QNAP devices running Kazoo Server?
CVE-2021-38680 allows remote attackers to inject malicious code through cross-site scripting (XSS) attacks on QNAP devices running Kazoo Server.
Which versions of Kazoo Server have fixed CVE-2021-38680?
CVE-2021-38680 has been fixed in Kazoo Server version 4.11.20 and later.
Where can I find more information about CVE-2021-38680?
You can find more information about CVE-2021-38680 in the QNAP Security Advisory QSA-21-54 at https://www.qnap.com/en/security-advisory/qsa-21-54.