CVE-2023-39299 Music Station

What is CVE-2023-39299?

CVE-2023-39299 is a high-severity path traversal vulnerability in QNAP Systems Inc. Music Station, published on 3 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following versions: Music Station 4.8.11 and later Music Station 5.1.16 and later Music Station 5.3.23 and later

Weakness: CWE-22

Which versions are affected by CVE-2023-39299?

It affects 1 product.

Products include Qnap Music Station.

How do I fix CVE-2023-39299?

No fix has been published for CVE-2023-39299 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-39299 being exploited?

There is no known exploitation of CVE-2023-39299 in the wild and no public exploit code.

Other vulnerabilities in QNAP Systems Inc. Music Station

• CVE-2018-19950 Command injection in Music Station Critical 9.8
• CVE-2018-0729 Command injection in QNAP NAS devices Critical 9.8
• CVE-2018-0718 Command injection in Music Station Critical 9.8
• CVE-2017-13069 Command injection in n/a Critical 9.8
• CVE-2023-23365 Music Station High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-227v-m6p6-j6gx.