Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-34360

A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later QuTScloud c4.5.6: Proxy Server 1.4.2 ( 2021/12/30 ) and later

Published

2022-05-26T14:15:07.883

Last Modified

2024-11-21T06:10:14.230

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-352
  • Type: Primary
    CWE-352
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application qnap nas_proxy_server < 1.4.2 Yes
Operating System qnap qts ≤ 4.5.4.2012 No
Application qnap nas_proxy_server < 1.4.3 Yes
Operating System qnap quts_hero h5.0.0 No
Application qnap nas_proxy_server < 1.4.2 Yes
Operating System qnap qutscloud c4.5.6 No
References