CVE-2020-2498
Last modified
CVE-2020-2498 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qnap | Quts Hero | < h4.5.1.1472 |
| Qnap | Qts | < 4.5.1.1456 |
| Qnap | Qts | < 4.4.3.1354 |
| Qnap | Qts | < 4.3.6.1333 |
| Qnap | Qts | < 4.3.4.1368 |
| Qnap | Qts | < 4.3.3.1315 |
| Qnap | Qts | < 4.2.6 |
References
- https://www.qnap.com/en/security-advisory/qsa-20-12Vendor Advisory
- https://www.qnap.com/en/security-advisory/qsa-20-12Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-2498?
How severe is CVE-2020-2498?
How do I fix CVE-2020-2498?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-24963An Authenticated Persistent XSS vulnerability was discovered…5.4
- CVE-2020-2497If exploited, this cross-site scripting vulnerability could …6.1
- CVE-2020-24972The Kleopatra component before 3.1.12 (and before 20.07.80) …8.8
- CVE-2020-24977GNOME project libxml2 v2.9.10 has a global buffer over-read …6.5
- CVE-2020-24978In NASM 2.15.04rc3, there is a double-free vulnerability in …9.8
- CVE-2020-24979Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-24980Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-24981An Incorrect Access Control vulnerability exists in /ucms/ch…5.3
- CVE-2020-24982An issue was discovered in Quadbase ExpressDashboard (EDAB) …4.3
- CVE-2020-24983An issue was discovered in Quadbase EspressReports ES 7 Upda…8.8
- CVE-2020-24984An issue was discovered in Quadbase EspressReports ES 7 Upda…8.8
- CVE-2020-24985An issue was discovered in Quadbase EspressReports ES 7 Upda…8.1
Are you affected by CVE-2020-2498?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST