CVE-2024-53691CWE-59

QTS, QuTS hero

High · published December 6, 2024

CVSS v4.0
8.7
EPSS
24%
Percentile
97.8
In the wild
Unconfirmed
What it is

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.

We have already fixed the vulnerability in the following versions:

QTS 5.1.8.2823 build 20240712 and later

QTS 5.2.0.2802 build 20240620 and later

QuTS hero h5.1.8.2823 build 20240712 and later

QuTS hero h5.2.0.2802 build 20240620 and later

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.23758 · 97.8th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2024-12-06T16:34Z
EPSS history
Timeline
  • 06 DEC 16:34Z
    QTS, QuTS hero
    cvelistv5