CVE-2023-32972

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-23-37	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:qnap:qts::::::::
	cpe:2.3:o:qnap:qts::::::::
	cpe:2.3:o:qnap:qts::::::::
	cpe:2.3:o:qnap:quts_hero::::::::
	cpe:2.3:o:qnap:quts_hero::::::::
	cpe:2.3:o:qnap:quts_hero::::::::
	cpe:2.3:o:qnap:qutscloud::::::::

History

10 Oct 2023, 20:54

Type	Values Removed	Values Added
CWE		CWE-787
First Time		Qnap qts Qnap Qnap quts Hero Qnap qutscloud
References	~~(MISC) https://www.qnap.com/en/security-advisory/qsa-23-37 -~~	(MISC) https://www.qnap.com/en/security-advisory/qsa-23-37 - Vendor Advisory
CPE		cpe:2.3:o:qnap:qts:::::::: cpe:2.3:o:qnap:quts_hero:::::::: cpe:2.3:o:qnap:qutscloud::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2

06 Oct 2023, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-06 17:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-32972

Mitre link : CVE-2023-32972

CVE.ORG link : CVE-2023-32972

JSON object : View

Products Affected

qnap

qts
quts_hero
qutscloud

CWE

CWE-787

Out-of-bounds Write

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2023-32972", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.2}]}, "published": "2023-10-06T17:15:12.170", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-23-37", "tags": ["Vendor Advisory"], "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2425 build 20230609 and later\nQTS 5.1.0.2444 build 20230629 and later\nQTS 4.5.4.2467 build 20230718 and later\nQuTS hero h5.0.1.2515 build 20230907 and later\nQuTS hero h5.1.0.2424 build 20230609 and later\nQuTS hero h4.5.4.2476 build 20230728 and later\nQuTScloud c5.1.0.2498 and later\n"}, {"lang": "es", "value": "Se ha informado que una copia del b\u00fafer sin verificar el tama\u00f1o de la vulnerabilidad de entrada afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los administradores autenticados ejecutar c\u00f3digo a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: \nQTS 5.0.1.2425 compilaci\u00f3n 20230609 y posteriores \nQTS 5.1.0.2444 compilaci\u00f3n 20230629 y posteriores \nQTS 4.5.4.2467 compilaci\u00f3n 20230718 y posteriores \nQuTS hero h5.0.1.2515 compilaci\u00f3n 20230907 y posteriores \nQuTS hero h5. 1.0.2424 compilaci\u00f3n 20230609 y posteriores \nQuTS hero h4.5.4.2476 compilaci\u00f3n 20230728 y posteriores \nQuTScloud c5.1.0.2498 y posteriores"}], "lastModified": "2023-10-10T20:54:43.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "956A4907-29B5-4CB4-BA77-9472E25C2246", "versionEndExcluding": "4.5.4.2467", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6143075-6287-4B3D-A59D-7EA7415C7F07", "versionEndExcluding": "5.0.1.2425", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "834347F5-87D2-479E-81BF-C5F23534E0F2", "versionEndExcluding": "5.1.0.2444", "versionStartIncluding": "5.1.0"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "039CB063-5347-4F85-B6DE-430A94C0B3DD", "versionEndExcluding": "h4.5.4.2476", "versionStartIncluding": "h4.5.0"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "703732BD-834B-4529-A2E8-AF956F5AD674", "versionEndExcluding": "h5.0.1.2515", "versionStartIncluding": "h5.0.0"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "757BF20E-81DA-447A-B90C-06D096EBACD1", "versionEndExcluding": "h5.1.0.2424", "versionStartIncluding": "h5.1.0"}, {"criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D3BB6CC-B9D6-4519-92F5-72F74D1A9C28", "versionEndExcluding": "c5.1.0.2498", "versionStartIncluding": "c5.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}