« Volver al listado

CVE-2020-2503

Estado: ModificadaMedia (5.4)—

If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Qnap — QES

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-2503",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@qnapsecurity.com.tw",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@qnapsecurity.com.tw",
      "affectedData": [
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QES",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.1.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "build 20201006"
          ]
        }
      ]
    }
  ],
  "published": "2020-12-24T02:15:12.547",
  "references": [
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-17",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-17",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@qnapsecurity.com.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        },
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later."
    },
    {
      "lang": "es",
      "value": "Si se explota, esta vulnerabilidad de tipo cross-site scripting almacenado podría permitir a atacantes remotos inyectar código malicioso en File Station. QNAP ya ha corregido estos problemas en QES versiones 2.1.1 Build 20201006 y posteriores"
    }
  ],
  "lastModified": "2026-06-17T03:12:14.673",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:qes:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5DBF31A-5D26-4C7D-8E69-31061FC16C6D",
              "versionEndExcluding": "2.1.1"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B075440F-4DEA-494D-AE27-1182CA4889D1"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200211:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67632014-C383-490C-B048-4DFE88AD3F30"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200303:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF83A348-E7B1-4008-8313-9F28B9A9B020"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200319:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAF45709-BE55-45A4-8DD1-0D3E417D8382"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200424:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C956E79-D019-4AE3-BB65-9A70282CD780"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200515:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB21A827-5B92-468F-9BD0-09EB3E8A2ED4"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200811:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA11F0F0-236A-4A24-9AF7-DC8E78D5AA3C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw"
}