« Back to list

CVE-2018-0711

Status: ModifiedMedium (6.1)—

Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Qnap — QTS

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2018-0711",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@qnapsecurity.com.tw",
      "affectedData": [
        {
          "vendor": "QNAP",
          "product": "QTS",
          "versions": [
            {
              "status": "affected",
              "version": "QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-04-30T13:29:00.323",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1040779",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201804-27",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "http://www.securitytracker.com/id/1040779",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201804-27",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad Cross-Site Scripting (XSS) en QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315,y sus versiones anteriores, permite que los atacantes remotos inyecten scripts web o HTML arbitrarios."
    }
  ],
  "lastModified": "2026-06-17T01:31:30.630",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0514:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5AA78A4-00D2-4168-8B48-0A23DD8B3C00"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0546:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BAA1736-2B5E-4F7B-9DC0-065CF4EF9A60"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3.0570:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE14B09E-69EE-479C-B523-D77C36A9D0D2"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0516:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "995F09C6-D7C2-493D-815E-E837B371E2E5"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0526:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BCCA5A5-C789-42FE-8652-F03618F095BE"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0551:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3230EF50-B2CC-4A4D-B353-7BE461BB235D"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0557:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DC8B14B-3882-44C4-9CE8-C5D6FC0BE00A"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0561:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D30204B8-097B-42EB-A7EC-9142F7D41EB0"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0569:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "945AE50D-8745-42B2-9B89-04B21C98657B"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0593:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BD98EC7-C26E-4AAB-AC6C-56A82C8C2432"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0597:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FDBAE33-D3A8-46C7-8C4E-CB0C12ED08B0"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0604:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A99818FC-0BC5-45A9-AD55-C02FC0AB1959"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw"
}