CVE-2021-44053: Reflected XSS

Q: What is CVE-2021-44053?

CVE-2021-44053 is a cross-site scripting (XSS) vulnerability that affects QNAP devices running QTS, QuTS hero, and QuTScloud.

Q: How does CVE-2021-44053 affect QNAP devices?

CVE-2021-44053 allows remote attackers to inject malicious code into QNAP devices.

Q: Which QNAP devices are affected by CVE-2021-44053?

QNAP devices running QTS, QuTS hero, and QuTScloud are affected by CVE-2021-44053.

Q: What is the severity of CVE-2021-44053?

CVE-2021-44053 has a severity level of 6.1 (medium).

Q: How can I fix CVE-2021-44053?

To fix CVE-2021-44053, you need to update your QTS, QuTS hero, or QuTScloud to the fixed versions provided by QNAP.

Published May 5, 2022

Updated

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later

Affected Software

34 affected components

QNAP QTS>=5.0.0.1716<5.0.0.1986

QNAP QTS>=4.3.3.0174<4.3.3.1945

QNAP QTS>=4.3.4.0899<4.3.4.1976

QNAP QTS>=4.3.6.0895<4.3.6.1965

QNAP QTS>=4.4.0.0883<4.5.4.1991

QNAP QTS=4.2.6-build_20170517

QNAP QTS=4.2.6-build_20190322

QNAP QTS=4.2.6-build_20190730

QNAP QTS=4.2.6-build_20190921

QNAP QTS=4.2.6-build_20191107

QNAP QTS=4.2.6-build_20200109

QNAP QTS=4.2.6-build_20200421

QNAP QTS=4.2.6-build_20200611

QNAP QTS=4.2.6-build_20200821

QNAP QTS=4.2.6-build_20210327

QNAP QTS=4.2.6-build_20211215

QNAP QuTS hero<h4.5.4.1771

QNAP QuTS hero>=h5.0.0.1772<h5.0.0.1986

QNAP QuTScloud<c5.0.1.1998

QNAP QTS>=4.3.3.0174<4.3.3.1945

QNAP QTS>=4.3.4.0899<4.3.4.1976

QNAP QTS>=4.3.6.0895<4.3.6.1965

QNAP QTS>=4.4.0.0883<4.5.4.1991

QNAP QTS=4.2.6-build_20170517

QNAP QTS=4.2.6-build_20190322

QNAP QTS=4.2.6-build_20190730

QNAP QTS=4.2.6-build_20190921

QNAP QTS=4.2.6-build_20191107

QNAP QTS=4.2.6-build_20200109

QNAP QTS=4.2.6-build_20200421

QNAP QTS=4.2.6-build_20200611

QNAP QTS=4.2.6-build_20200821

QNAP QTS=4.2.6-build_20210327

QNAP QTS=4.2.6-build_20211215

Remediation

Information

We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later

Event History

May 5, 2022

CVE Published

via MITRE·04:50 PM

Data Sourced

via MITRE·04:50 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-44053?

CVE-2021-44053 is a cross-site scripting (XSS) vulnerability that affects QNAP devices running QTS, QuTS hero, and QuTScloud.

How does CVE-2021-44053 affect QNAP devices?