« Volver al listado

CVE-2020-2504

Estado: ModificadaAlta (7.5)—

If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Qnap — QES

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-2504",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@qnapsecurity.com.tw",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@qnapsecurity.com.tw",
      "affectedData": [
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QES",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.1.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "build 20201006"
          ]
        }
      ]
    }
  ],
  "published": "2020-12-24T02:15:12.657",
  "references": [
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-17",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-17",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@qnapsecurity.com.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later."
    },
    {
      "lang": "es",
      "value": "Si se explota, esta vulnerabilidad de salto de ruta absoluta podría permitir a atacantes saltar archivos en File Station. QNAP ya ha corregido estos problemas en QES versiones 2.1.1 Build 20201006 y posteriores"
    }
  ],
  "lastModified": "2026-06-17T03:12:14.797",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:qes:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5DBF31A-5D26-4C7D-8E69-31061FC16C6D",
              "versionEndExcluding": "2.1.1"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B075440F-4DEA-494D-AE27-1182CA4889D1"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200211:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67632014-C383-490C-B048-4DFE88AD3F30"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200303:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF83A348-E7B1-4008-8313-9F28B9A9B020"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200319:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAF45709-BE55-45A4-8DD1-0D3E417D8382"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200424:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C956E79-D019-4AE3-BB65-9A70282CD780"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200515:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB21A827-5B92-468F-9BD0-09EB3E8A2ED4"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200811:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA11F0F0-236A-4A24-9AF7-DC8E78D5AA3C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw"
}