CVE-2018-19943
Last modified
CVE-2018-19943 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. CISA has confirmed active exploitation in the wild. EPSS estimates a 17.71% chance of exploitation in the next 30 days.
Description
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qnap | Qts | < 4.2.6 |
| Qnap | Qts | >= 4.3.1.0013, < 4.3.3.1252 |
| Qnap | Qts | >= 4.3.4, < 4.3.4.1282 |
| Qnap | Qts | >= 4.3.6, < 4.3.6.1263 |
| Qnap | Qts | >= 4.4.0, < 4.4.1.1261 |
| Qnap | Qts | >= 4.4.2, < 4.4.2.1270 |
| Qnap | Qts | 4.2.6 |
References
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-01Vendor Advisory
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-01Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2018-19943?
How severe is CVE-2018-19943?
How do I fix CVE-2018-19943?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-19936PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.
- CVE-2018-19937A local, authenticated attacker can bypass the passcode in t…6.6
- CVE-2018-19939The Goodix GT9xx touchscreen driver for custom Linux kernels…7.5
- CVE-2018-1994IBM InfoSphere Information Server 11.5 and 11.7 is vulnerabl…6.3
- CVE-2018-19941A vulnerability has been reported to affect QNAP NAS. If exp…7.5
- CVE-2018-19942A cross-site scripting (XSS) vulnerability has been reported…6.1
- CVE-2018-19944A cleartext transmission of sensitive information vulnerabil…7.5
- CVE-2018-19945A vulnerability has been reported to affect earlier QNAP dev…9.1
- CVE-2018-19946The vulnerability have been reported to affect earlier versi…5.9
- CVE-2018-19947The vulnerability have been reported to affect earlier versi…6.5
- CVE-2018-19948The vulnerability have been reported to affect earlier versi…6.5
- CVE-2018-19949If exploited, this command injection vulnerability could all…9.8
Are you affected by CVE-2018-19943?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST