What is CVE-2021-38693?

CVE-2021-38693 is a path traversal vulnerability affecting QNAP devices running QuTScloud, QuTS hero, QTS, QVR Pro Appliance.

How can CVE-2021-38693 be exploited?

CVE-2021-38693 can be exploited by attackers to read the contents of unexpected files and expose sensitive data.

Which QNAP devices are affected by CVE-2021-38693?

QNAP devices running QuTScloud, QuTS hero, QTS, QVR Pro Appliance are affected by CVE-2021-38693.

What is the severity of CVE-2021-38693?

CVE-2021-38693 has a severity rating of 5.3 (medium).

How can I fix CVE-2021-38693?

To fix CVE-2021-38693, you should install the security patch provided by QNAP. Please refer to the QNAP security advisory for more information.

Vulnerability/
CVE-2021-38693

medium

5.3

CWE

5/5/2022

13/5/2022

CVE-2021-38693: Path Traversal

First published: Thu May 05 2022(Updated: )

A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Credit: security@qnapsecurity.com.tw

Affected Software	Affected Version	How to fix
QNAP QTS	<4.5.4.1991
QNAP QTS	>=5.0.0.1716<5.0.0.1986
QNAP QuTS hero	>=h5.0.0.1772<h5.0.0.1949
QNAP QuTScloud	<c5.0.1.1949

Never miss a vulnerability like this again

Reference Links

https://www.qnap.com/en/security-advisory/qsa-22-13

Frequently Asked Questions

What is CVE-2021-38693?
CVE-2021-38693 is a path traversal vulnerability affecting QNAP devices running QuTScloud, QuTS hero, QTS, QVR Pro Appliance.
How can CVE-2021-38693 be exploited?
CVE-2021-38693 can be exploited by attackers to read the contents of unexpected files and expose sensitive data.
Which QNAP devices are affected by CVE-2021-38693?
QNAP devices running QuTScloud, QuTS hero, QTS, QVR Pro Appliance are affected by CVE-2021-38693.
What is the severity of CVE-2021-38693?
CVE-2021-38693 has a severity rating of 5.3 (medium).
How can I fix CVE-2021-38693?
To fix CVE-2021-38693, you should install the security patch provided by QNAP. Please refer to the QNAP security advisory for more information.

agent/severity
agent/author
agent/references
agent/type
agent/weakness
agent/description
agent/last-modified-date
agent/first-publish-date
agent/tags
agent/softwarecombine
agent/event
collector/nvd-index
agent/software-canonical-lookup-request
vendor/qnap
canonical/qnap qts
version/qnap qts/5.0.0.1716
canonical/qnap quts hero
version/qnap quts hero/h5.0.0.1772
canonical/qnap qutscloud

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.