CVE-2023-47221 Photo Station

What is CVE-2023-47221?

CVE-2023-47221 is a medium-severity path traversal vulnerability in QNAP Systems Inc. Photo Station, published on 8 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following version: Photo Station 6.4.2 ( 2023/12/15 ) and later

Weakness: CWE-22

Which versions are affected by CVE-2023-47221?

It affects 1 product.

Products include Qnap Photo Station.

How do I fix CVE-2023-47221?

No fix has been published for CVE-2023-47221 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-47221 being exploited?

There is no known exploitation of CVE-2023-47221 in the wild and no public exploit code.

Other vulnerabilities in QNAP Systems Inc. Photo Station

• CVE-2022-27593 QNAP Photo Station Externally Controlled Reference Exploited Critical 10.0
• CVE-2019-7192 QNAP Photo Station Improper Access Control Exploited Critical 9.8
• CVE-2019-7194 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2019-7195 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2017-20210 Photo Station Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2v7w-v8fj-mf99.