CVE-2023-23372: QTS, QuTS hero

Published Dec 8, 2023

Updated

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network.

We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h4.5.4.2476 build 20230728 and later

Affected Software

47 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.0.1.2034-build_20220515

QNAP QTS=5.0.1.2079-build_20220629

QNAP QTS=5.0.1.2131-build_20220820

QNAP QTS=5.0.1.2137-build_20220826

QNAP QTS=5.0.1.2145-build_20220903

QNAP QTS=5.0.1.2173-build_20221001

QNAP QTS=5.0.1.2194-build_20221022

QNAP QTS=5.0.1.2234-build_20221201

QNAP QTS=5.0.1.2248-build_20221215

QNAP QTS=5.0.1.2277-build_20230112

QNAP QTS=5.0.1.2346-build_20230322

QNAP QTS=5.0.1.2376-build_20230421

QNAP QTS=4.5.4.1715-build_20210630

QNAP QTS=4.5.4.1723-build_20210708

QNAP QTS=4.5.4.1741-build_20210726

QNAP QTS=4.5.4.1787-build_20210910

QNAP QTS=4.5.4.1800-build_20210923

QNAP QTS=4.5.4.1892-build_20211223

QNAP QTS=4.5.4.1931-build_20220128

QNAP QTS=4.5.4.2012-build_20220419

QNAP QTS=4.5.4.2117-build_20220802

QNAP QTS=4.5.4.2280-build_20230112

QNAP QTS=4.5.4.2374-build_20230416

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.0.1.2045-build_20220526

QNAP QuTS hero=h5.0.1.2192-build_20221020

QNAP QuTS hero=h5.0.1.2248-build_20221215

QNAP QuTS hero=h5.0.1.2269-build_20230104

QNAP QuTS hero=h5.0.1.2277-build_20230112

QNAP QuTS hero=h5.0.1.2348-build_20230324

QNAP QuTS hero=h5.0.1.2376-build_20230421

QNAP QuTS hero=h4.5.4.1771-build_20210825

QNAP QuTS hero=h4.5.4.1800-build_20210923

QNAP QuTS hero=h4.5.4.1813-build_20211006

QNAP QuTS hero=h4.5.4.1848-build_20211109

QNAP QuTS hero=h4.5.4.1892-build_20211223

QNAP QuTS hero=h4.5.4.1951-build_20220218

QNAP QuTS hero=h4.5.4.1971-build_20220310

QNAP QuTS hero=h4.5.4.1991-build_20220330

QNAP QuTS hero=h4.5.4.2052-build_20220530

QNAP QuTS hero=h4.5.4.2138-build_20220824

QNAP QuTS hero=h4.5.4.2217-build_20221111

QNAP QuTS hero=h4.5.4.2272-build_20230105

QNAP QuTS hero=h4.5.4.2374-build_20230417

Remediation

Information

Event History

Dec 8, 2023

CVE Published

04:07 PM

Data Sourced

04:07 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-23372?

CVE-2023-23372 is considered a high severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2023-23372?

To fix CVE-2023-23372, upgrade to the latest patched version of QNAP QTS or QuTS hero as specified by the vendor.

Which QNAP operating systems are affected by CVE-2023-23372?

CVE-2023-23372 affects multiple versions of QNAP QTS and QuTS hero, specifically several builds of 4.5 and 5.0 series.

Can CVE-2023-23372 be exploited remotely?

Yes, CVE-2023-23372 can be exploited remotely via a network by injecting malicious code.

When was CVE-2023-23372 published?

CVE-2023-23372 was publicly reported in 2023.