CVE-2024-21902CWE-200CWE-732

QTS, QuTS hero

Medium · published May 21, 2024

CVSS v3.1
6.4
EPSS
0%
Percentile
27.7
In the wild
Unconfirmed
What it is

An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network.

We have already fixed the vulnerability in the following version:

QTS 5.1.7.2770 build 20240520 and later

QuTS hero h5.1.7.2770 build 20240520 and later

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.7th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2024-05-21T16:08Z
EPSS history
Timeline
  • 21 MAY 16:08Z
    QTS, QuTS hero
    cvelistv5