CVE-2020-2504CWE-20CWE-22CWE-284CWE-73

Absolute path traversal vulnerability in QES

Medium · published December 24, 2020

CVSS v3.1
5.8
EPSS
1%
Percentile
63.4
In the wild
Unconfirmed
What it is

If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01029 · 63.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-284 · Improper Access Control; CWE-73 · External Control of File Name or Path
Published
2020-12-24T01:39Z
EPSS history
Timeline
  • 24 DEC 01:39Z
    Absolute path traversal vulnerability in QES
    cvelistv5