CVE-2024-32767 Photo Station

What is CVE-2024-32767?

CVE-2024-32767 is a medium-severity cross-site scripting vulnerability in QNAP Systems Inc. Photo Station, published on 22 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code.

We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later

Weakness: CWE-79

Which versions are affected by CVE-2024-32767?

It affects 1 product.

Products include Qnap Photo Station.

How do I fix CVE-2024-32767?

No fix has been published for CVE-2024-32767 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-32767 being exploited?

There is no known exploitation of CVE-2024-32767 in the wild and no public exploit code.

Other vulnerabilities in QNAP Systems Inc. Photo Station

• CVE-2022-27593 QNAP Photo Station Externally Controlled Reference Exploited Critical 10.0
• CVE-2019-7192 QNAP Photo Station Improper Access Control Exploited Critical 9.8
• CVE-2019-7194 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2019-7195 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2017-20210 Photo Station Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xwww-jpfc-7835.