« Volver al listado

CVE-2023-32969

Estado: AnalizadaMedia (4.8)—

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network.

We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Qnap — QTSQnap — Quts HeroQnap — Qutscloud

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-32969",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-32969",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-11T17:21:27.707772Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@qnapsecurity.com.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "security@qnapsecurity.com.tw",
      "affectedData": [
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QuTScloud",
          "versions": [
            {
              "status": "affected",
              "version": "c5.x.x",
              "lessThan": "c5.1.5.2651",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QTS",
          "versions": [
            {
              "status": "affected",
              "version": "5.1.x",
              "lessThan": "5.1.4.2596 build 20231128",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QuTS hero",
          "versions": [
            {
              "status": "affected",
              "version": "h5.1.x",
              "lessThan": "h5.1.4.2596 build 20231128",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-03-08T17:15:21.613",
  "references": [
    {
      "url": "https://www.qnap.com/en/security-advisory/qsa-24-11",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "https://www.qnap.com/en/security-advisory/qsa-24-11",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@qnapsecurity.com.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQuTScloud c5.1.5.2651 and later\nQTS 5.1.4.2596 build 20231128 and later\nQuTS hero h5.1.4.2596 build 20231128 and later\n"
    },
    {
      "lang": "es",
      "value": "Se ha informado que una vulnerabilidad de cross-site scripting (XSS) afecta la red y el conmutador virtual. Si se explota, la vulnerabilidad podría permitir a los administradores autenticados inyectar código malicioso a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QuTScloud c5.1.5.2651 y posteriores QTS 5.1.4.2596 compilación 20231128 y posteriores QuTS hero h5.1.4.2596 compilación 20231128 y posteriores"
    }
  ],
  "lastModified": "2026-06-17T05:59:56.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D3382F7-0B79-4E0B-BD47-90B097EF8E15",
              "versionEndExcluding": "5.1.4.2596",
              "versionStartIncluding": "5.1.0"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:5.1.4.2596:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "632DA602-2920-4418-B6E3-1AA9EA671FD4"
            },
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F5FA6B3-BBA8-4B76-96FE-D73FE651BA14",
              "versionEndExcluding": "h5.1.4.2596",
              "versionStartIncluding": "h5.1.0"
            },
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.1.4.2596:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A2A0A37-D0A4-4801-BED4-D367188EFF00"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B9BF274-5800-4A1E-A2BE-9E7B62BBF9BC",
              "versionEndExcluding": "c5.1.5.2651",
              "versionStartIncluding": "c5.0.0.1919"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw"
}