CVE-2019-7197
Last modified
CVE-2019-7197 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. EPSS estimates a 1.15% chance of exploitation in the next 30 days.
Description
A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qnap | Qts | 4.2.6 |
| Qnap | Qts | 4.3.3 |
| Qnap | Qts | 4.3.4 |
| Qnap | Qts | 4.3.6 |
| Qnap | Qts | 4.4.1 |
References
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-26Vendor Advisory
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-26Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-7197?
How severe is CVE-2019-7197?
How do I fix CVE-2019-7197?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-7184This cross-site scripting (XSS) vulnerability in Video Stati…4.8
- CVE-2019-7185This cross-site scripting (XSS) vulnerability in Music Stati…4.8
- CVE-2019-7192This improper access control vulnerability allows remote att…9.8
- CVE-2019-7193This improper input validation vulnerability allows remote a…9.8
- CVE-2019-7194This external control of file name or path vulnerability all…9.8
- CVE-2019-7195This external control of file name or path vulnerability all…9.8
- CVE-2019-7198This command injection vulnerability allows attackers to exe…9.8
- CVE-2019-7201An unquoted service path vulnerability is reported to affect…7.8
- CVE-2019-7211SmarterTools SmarterMail 16.x before build 6995 has stored X…
- CVE-2019-7212SmarterTools SmarterMail 16.x before build 6985 has hardcode…
- CVE-2019-7213SmarterTools SmarterMail 16.x before build 6985 allows direc…
- CVE-2019-7214SmarterTools SmarterMail 16.x before build 6985 allows deser…
Are you affected by CVE-2019-7197?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST