CVE-2020-2502 Cross-site Scripting Vulnerability in Photo Station

What is CVE-2020-2502?

CVE-2020-2502 is a medium-severity cross-site scripting vulnerability in QNAP Systems Inc. Photo Station, published on 17 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later

Weakness: CWE-80, CWE-79

Which versions are affected by CVE-2020-2502?

It affects 1 product.

Products include Qnap Photo Station.

How do I fix CVE-2020-2502?

No fix has been published for CVE-2020-2502 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-2502 being exploited?

There is no known exploitation of CVE-2020-2502 in the wild and no public exploit code.

Other vulnerabilities in QNAP Systems Inc. Photo Station

• CVE-2022-27593 QNAP Photo Station Externally Controlled Reference Exploited Critical 10.0
• CVE-2019-7192 QNAP Photo Station Improper Access Control Exploited Critical 9.8
• CVE-2019-7194 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2019-7195 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2017-20210 Photo Station Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rfgf-6g5x-fx98.