CVE-2023-50364

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50364
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

6.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://www.qnap.com/en/security-advisory/qsa-24-20
Configurations

No configuration.

History

09 May 2024, 01:15

Type Values Removed Values Added
Summary
  • (es) Se ha informado que una copia del búfer sin verificar el tamaño de la vulnerabilidad de entrada afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los administradores autenticados ejecutar código a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.6.2722 build 20240402 y posteriores QuTS hero h5.1.6.2734 build 20240414 y posteriores
Summary (en) A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later (en) A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later
CVSS v2 : unknown
v3 : 5.5 		v2 : unknown
v3 : 6.4

26 Apr 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-26 15:15

Updated : 2024-05-09 01:15

NVD link : CVE-2023-50364

Mitre link : CVE-2023-50364

CVE.ORG link : CVE-2023-50364

JSON object : View

Products Affected

No product.

CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-122

Heap-based Buffer Overflow