CVE-2020-2497 Cross-site scripting vulnerability in QTS and QuTS hero
Remote attackers can inject malicious code into System Connection Logs, potentially leading to code execution or account takeover on QNAP NAS devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-2497?
CVE-2020-2497 is a medium-severity cross-site scripting vulnerability in Qnap Qts, published on 10 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
Which versions are affected by CVE-2020-2497?
It affects 2 products.
Products include Qnap Qts, Qnap Quts Hero.
How do I fix CVE-2020-2497?
No fix has been published for CVE-2020-2497 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-2497 being exploited?
There is no known exploitation of CVE-2020-2497 in the wild and no public exploit code.
Other vulnerabilities in Qnap Qts
Sources
Also known as GHSA-37xw-27xp-5499.