« Volver al listado

CVE-2013-7174

Estado: ModificadaAlta (7.8)—

Vulnerabilidad de recorrido de directorios absoluto en cgi-bin/jc.cgi en QNAP QTS anteriores 4.1.0 permite a atacantes remotos leer archivos de forma arbitraria a través de una ruta completa en el parametro f.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Qnap — QTS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-7174",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-01-09T18:07:26.347",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/487078",
      "tags": [
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/64719",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1029577",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/487078",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/64719",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1029577",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de recorrido de directorios absoluto en cgi-bin/jc.cgi en QNAP QTS  anteriores 4.1.0 permite a atacantes remotos leer archivos de forma arbitraria a través de una ruta completa en el parametro f."
    }
  ],
  "lastModified": "2026-06-17T00:01:29.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49FE2174-B649-4C57-951A-A5CD2A3BFA46",
              "versionEndIncluding": "4.0.3"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22B1327F-9D79-4973-8904-97AE5965DBBF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}