CVE-2024-38640: Download Station
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.
We have already fixed the vulnerability in the following version: Download Station 5.8.6.283 ( 2024/06/21 ) and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38640?
CVE-2024-38640 is considered a high-severity cross-site scripting (XSS) vulnerability affecting Download Station.
How do I fix CVE-2024-38640?
To fix CVE-2024-38640, update Download Station to version 5.8.6.2 or later.
Who is affected by CVE-2024-38640?
Authenticated users of vulnerable versions of Qnap Download Station between 5.8.0 and 5.8.6.283 are affected by CVE-2024-38640.
What can happen if CVE-2024-38640 is exploited?
Exploitation of CVE-2024-38640 could allow attackers to inject malicious code through the Download Station interface.
Are there any known exploits for CVE-2024-38640?
At this time, there are no public exploits reported specifically for CVE-2024-38640, but potential risks exist due to its XSS nature.