ByteOS Network

NVD Vulnerability Details :

CVE-2018-19957

Analyzed

Source-security@qnapsecurity.com.tw

Published At-10 Sep, 2021 | 04:15

Updated At-23 Sep, 2021 | 15:49

A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

QNAP Systems, Inc.

>>qts>>Versions before 4.5.4.1715(exclusive)

cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>Versions before h4.5.4.1771(exclusive)

cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>qutscloud>>Versions before c4.5.6.1755(exclusive)

cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-1021	Primary	nvd@nist.gov
CWE-1021	Secondary	security@qnapsecurity.com.tw

References

Hyperlink	Source	Resource
https://www.qnap.com/en/security-advisory/qsa-21-03	security@qnapsecurity.com.tw	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History