CVE-2023-50363: QTS, QuTS hero

Published Apr 26, 2024

Updated

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

Affected Software

21 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578-build_20231110

QNAP QTS=5.1.4.2596-build_20231128

QNAP QTS=5.1.5.2645-build_20240116

QNAP QTS=5.1.5.2679-build_20240219

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578-build_20231110

QNAP QuTS hero=h5.1.4.2596-build_20231128

QNAP QuTS hero=h5.1.5.2647-build_20240118

QNAP QuTS hero=h5.1.5.2680-build_20240220

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

Event History

Apr 26, 2024

CVE Published

via MITRE·03:01 PM

Data Sourced

via MITRE·03:01 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-50363?

CVE-2023-50363 is categorized as a moderate severity vulnerability due to the potential for authenticated users to bypass access restrictions.

How do I fix CVE-2023-50363?

To fix CVE-2023-50363, update the QNAP operating system to the latest version as specified in the security advisory.

Which QNAP operating system versions are affected by CVE-2023-50363?

CVE-2023-50363 affects multiple QNAP QTS and QuTS hero versions, including 5.1.0.2348 through 5.1.5.2679 and their corresponding QuTS hero builds.

Can CVE-2023-50363 be exploited remotely?

Yes, CVE-2023-50363 can be exploited remotely by authenticated users who can leverage the vulnerability to bypass intended access controls.

Is it necessary to reboot after applying the fix for CVE-2023-50363?

Yes, it is generally recommended to reboot the system after applying the update to ensure that all changes take effect.