CVE-2021-34354 Stored Cross-site Scripting Vulnerability in Photo Station

What is CVE-2021-34354?

CVE-2021-34354 is a high-severity cross-site scripting vulnerability in QNAP Systems Inc. Photo Station, published on 1 Oct 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later

Weakness: CWE-79

Which versions are affected by CVE-2021-34354?

It affects 1 product.

Products include Qnap Photo Station.

How do I fix CVE-2021-34354?

No fix has been published for CVE-2021-34354 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-34354 being exploited?

There is no known exploitation of CVE-2021-34354 in the wild and no public exploit code.

Other vulnerabilities in QNAP Systems Inc. Photo Station

• CVE-2022-27593 QNAP Photo Station Externally Controlled Reference Exploited Critical 10.0
• CVE-2019-7192 QNAP Photo Station Improper Access Control Exploited Critical 9.8
• CVE-2019-7194 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2019-7195 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2017-20210 Photo Station Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rv2c-7323-hh89.