CVE-2018-19957
Last modified
CVE-2018-19957 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. EPSS estimates a 0.69% chance of exploitation in the next 30 days.
Description
A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qnap | Qts | < 4.5.4.1715 |
| Qnap | Quts Hero | < h4.5.4.1771 |
| Qnap | Qutscloud | < c4.5.6.1755 |
References
- https://www.qnap.com/en/security-advisory/qsa-21-03Vendor Advisory
- https://www.qnap.com/en/security-advisory/qsa-21-03Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-19957?
How severe is CVE-2018-19957?
How do I fix CVE-2018-19957?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-19951If exploited, this cross-site scripting vulnerability could …6.1
- CVE-2018-19952If exploited, this SQL injection vulnerability could allow r…7.5
- CVE-2018-19953If exploited, this cross-site scripting vulnerability could …6.1
- CVE-2018-19954The cross-site scripting vulnerability has been reported to …6.1
- CVE-2018-19955The cross-site scripting vulnerability has been reported to …6.1
- CVE-2018-19956The cross-site scripting vulnerability has been reported to …6.1
- CVE-2018-1996IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 coul…5.3
- CVE-2018-19960The debug_mode function in web/web.py in OnionShare through …
- CVE-2018-19961An issue was discovered in Xen through 4.11.x on AMD x86 pla…
- CVE-2018-19962An issue was discovered in Xen through 4.11.x on AMD x86 pla…
- CVE-2018-19963An issue was discovered in Xen 4.11 allowing HVM guest OS us…
- CVE-2018-19964An issue was discovered in Xen 4.11.x allowing x86 guest OS …
Are you affected by CVE-2018-19957?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST