A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later QuTScloud c4.5.6: Proxy Server 1.4.2 ( 2021/12/30 ) and later
References
Link | Resource |
---|---|
https://www.qnap.com/en/security-advisory/qsa-22-18 | Vendor Advisory |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
AND |
|
Configuration 3 (hide)
AND |
|
History
07 Jun 2022, 16:27
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:qnap:quts_hero:h5.0.0:*:*:*:*:*:*:* cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* cpe:2.3:o:qnap:qutscloud:c4.5.6:-:*:*:*:*:*:* cpe:2.3:a:qnap:nas_proxy_server:*:*:*:*:*:*:*:* |
|
CWE | CWE-352 | |
References | (MISC) https://www.qnap.com/en/security-advisory/qsa-22-18 - Vendor Advisory | |
CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 8.8 |
First Time |
Qnap
Qnap nas Proxy Server Qnap quts Hero Qnap qts Qnap qutscloud |
26 May 2022, 14:25
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-05-26 14:15
Updated : 2023-12-10 14:22
NVD link : CVE-2021-34360
Mitre link : CVE-2021-34360
CVE.ORG link : CVE-2021-34360
JSON object : View
Products Affected
qnap
- quts_hero
- qutscloud
- nas_proxy_server
- qts
CWE
CWE-352
Cross-Site Request Forgery (CSRF)