CVE-2023-50363
Last modified
CVE-2023-50363 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later . EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Qnap | Qts | 5.1.0.2348 | Build 20230325 |
| Qnap | Qts | 5.1.0.2399 | Build 20230515 |
| Qnap | Qts | 5.1.0.2418 | Build 20230603 |
| Qnap | Qts | 5.1.0.2444 | Build 20230629 |
| Qnap | Qts | 5.1.0.2466 | Build 20230721 |
| Qnap | Qts | 5.1.1.2491 | Build 20230815 |
| Qnap | Qts | 5.1.2.2533 | Build 20230926 |
| Qnap | Qts | 5.1.3.2578 | Build 20231110 |
| Qnap | Qts | 5.1.4.2596 | Build 20231128 |
| Qnap | Qts | 5.1.5.2645 | Build 20240116 |
| Qnap | Qts | 5.1.5.2679 | Build 20240219 |
| Qnap | Quts Hero | h5.1.0.2409 | Build 20230525 |
| Qnap | Quts Hero | h5.1.0.2424 | Build 20230609 |
| Qnap | Quts Hero | h5.1.0.2453 | Build 20230708 |
| Qnap | Quts Hero | h5.1.0.2466 | Build 20230721 |
| Qnap | Quts Hero | h5.1.1.2488 | Build 20230812 |
| Qnap | Quts Hero | h5.1.2.2534 | Build 20230927 |
| Qnap | Quts Hero | h5.1.3.2578 | Build 20231110 |
| Qnap | Quts Hero | h5.1.4.2596 | Build 20231128 |
| Qnap | Quts Hero | h5.1.5.2647 | Build 20240118 |
| Qnap | Quts Hero | h5.1.5.2680 | Build 20240220 |
References
- https://www.qnap.com/en/security-advisory/qsa-24-20Vendor Advisory
- https://www.qnap.com/en/security-advisory/qsa-24-20Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-50363?
How severe is CVE-2023-50363?
How do I fix CVE-2023-50363?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-50358An OS command injection vulnerability has been reported to a…5.8
- CVE-2023-50359An unchecked return value vulnerability has been reported to…6.7
- CVE-2023-5036Cross-Site Request Forgery (CSRF) in GitHub repository useme…8.8
- CVE-2023-50360A SQL injection vulnerability has been reported to affect Vi…8.8
- CVE-2023-50361A buffer copy without checking size of input vulnerability h…8.8
- CVE-2023-50362A buffer copy without checking size of input vulnerability h…8.8
- CVE-2023-50364A buffer copy without checking size of input vulnerability h…8.8
- CVE-2023-50366A cross-site scripting (XSS) vulnerability has been reported…4.8
- CVE-2023-50368Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2023-50369Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2023-5037badmonkey, a Security Researcher has found a flaw that allow…7.2
- CVE-2023-50370Improper Neutralization of Input During Web Page Generation …5.4
Are you affected by CVE-2023-50363?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST