CVE-2021-28805CWE-540

Inclusion of Sensitive Information in QSS

High · published June 11, 2021

CVSS v3.1
7.8
EPSS
0%
Percentile
14.0
In the wild
Unconfirmed
What it is

Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00238 · 14.0th percentile
Weakness
CWE-540 · Inclusion of Sensitive Information in Source Code
Published
2021-06-11T06:35Z
EPSS history
Timeline
  • 11 JUN 06:35Z
    Inclusion of Sensitive Information in QSS
    cvelistv5