CWE
601
Advisory Published
CVE Published
Updated

CVE-2021-44054: Open redirect

First published: Thu May 05 2022(Updated: )

An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Credit: security@qnapsecurity.com.tw security@qnapsecurity.com.tw

Affected SoftwareAffected VersionHow to fix
QNAP QTS>=5.0.0.1716<5.0.0.1986
QNAP QTS>=4.3.3.0174<4.3.3.1945
QNAP QTS>=4.3.4.0899<4.3.4.1976
QNAP QTS>=4.3.6.0895<4.3.6.1965
QNAP QTS>=4.4.0.0883<4.5.4.1991
QNAP QTS=4.2.6-build_20170517
QNAP QTS=4.2.6-build_20190322
QNAP QTS=4.2.6-build_20190730
QNAP QTS=4.2.6-build_20190921
QNAP QTS=4.2.6-build_20191107
QNAP QTS=4.2.6-build_20200109
QNAP QTS=4.2.6-build_20200421
QNAP QTS=4.2.6-build_20200611
QNAP QTS=4.2.6-build_20200821
QNAP QTS=4.2.6-build_20210327
QNAP QTS=4.2.6-build_20211215
QNAP QuTS hero<h4.5.4.1771
QNAP QuTS hero>=h5.0.0.1772<h5.0.0.1986
QNAP QuTScloud<c5.0.1.1998
QNAP QTS>=4.3.3.0174<4.3.3.1945
QNAP QTS>=4.3.4.0899<4.3.4.1976
QNAP QTS>=4.3.6.0895<4.3.6.1965
QNAP QTS>=4.4.0.0883<4.5.4.1991
QNAP QTS=4.2.6-build_20170517
QNAP QTS=4.2.6-build_20190322
QNAP QTS=4.2.6-build_20190730
QNAP QTS=4.2.6-build_20190921
QNAP QTS=4.2.6-build_20191107
QNAP QTS=4.2.6-build_20200109
QNAP QTS=4.2.6-build_20200421
QNAP QTS=4.2.6-build_20200611
QNAP QTS=4.2.6-build_20200821
QNAP QTS=4.2.6-build_20210327
QNAP QTS=4.2.6-build_20211215

Remedy

We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2021-44054?

    CVE-2021-44054 is an open redirect vulnerability affecting QNAP devices running QuTScloud, QuTS hero, and QTS.

  • How does CVE-2021-44054 impact users?

    CVE-2021-44054 allows attackers to redirect users to untrusted pages that may contain malware.

  • Which software versions are affected by CVE-2021-44054?

    CVE-2021-44054 affects various versions of QNAP QTS, QNAP QTS hero, and QNAP QTScloud.

  • How severe is CVE-2021-44054?

    CVE-2021-44054 has a medium severity rating with a CVSS score of 6.1.

  • How can I fix CVE-2021-44054?

    To fix CVE-2021-44054, update your QNAP device to the fixed versions mentioned in the QNAP Security Advisory QSA-22-16.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203