Read the docs
TI-2018-14130 Aliases CVE-2018-19942GHSA-v5p8-3v95-73c8

Cross-site Scripting Vulnerability in File Station

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)

Why it matters now

EPSS 0.00773 55th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.5.2.1566 build 20210202, 4.5.1.1456 build 20201015, 4.3.6.1446 build 20200929 +3QuTS hero (QNAP Systems Inc.): h4.5.1.1472 build 20201031+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTSbefore 4.5.2.1566 build 20210202; before 4.5.1.1456 build 20201015; before 4.3.6.1446 build 20200929; before 4.3.4.1463 build 20201006; before 4.3.3.1432 build 20201006; before 4.2.6 build 202103274.5.2.1566 build 20210202, 4.5.1.1456 build 20201015, 4.3.6.1446 build 20200929, 4.3.4.1463 build 20201006, 4.3.3.1432 build 20201006, 4.2.6 build 20210327Patch availableCNA
QNAPQuTS herobefore h4.5.1.1472 build 20201031h4.5.1.1472 build 20201031Patch availableCNA
QNAPQuTScloudbefore c4.5.4.1601 build 20210309; before c4.5.3.1454 build 20201013c4.5.4.1601 build 20210309, c4.5.3.1454 build 20201013Patch availableCNA
  • QTS VendorQNAP Affected before 4.5.2.1566 build 20210202; before 4.5.1.1456 build 20201015; before 4.3.6.1446 build 20200929; before 4.3.4.1463 build 20201006; before 4.3.3.1432 build 20201006; before 4.2.6 build 20210327 Fixed in 4.5.2.1566 build 20210202, 4.5.1.1456 build 20201015, 4.3.6.1446 build 20200929, 4.3.4.1463 build 20201006, 4.3.3.1432 build 20201006, 4.2.6 build 20210327 Patch available CNA
  • QuTS hero VendorQNAP Affected before h4.5.1.1472 build 20201031 Fixed in h4.5.1.1472 build 20201031 Patch available CNA
  • QuTScloud VendorQNAP Affected before c4.5.4.1601 build 20210309; before c4.5.3.1454 build 20201013 Fixed in c4.5.4.1601 build 20210309, c4.5.3.1454 build 20201013 Patch available CNA

CPE configurations NVD · 105

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*before 4.2.6; 4.3.5 to before 4.3.6; 4.4.0 to before 4.5.1VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*4.2.6VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*4.2.6 build_20170517VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*4.2.6 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*4.2.6 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*4.2.6 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*4.2.6 build_20191107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*4.2.6 build_20200109VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*4.2.6 build_20200421VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*4.2.6 build_20200611VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.2.6; 4.3.5 to before 4.3.6; 4.4.0 to before 4.5.1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* Versions 4.2.6 build_20200109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* Versions 4.2.6 build_20200421 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* Versions 4.2.6 build_20200611 Vulnerable ·QNAP
Show 95 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*4.2.6 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*4.3.3VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0095:*:*:*:*:*:*:*4.3.3.0095VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0096:*:*:*:*:*:*:*4.3.3.0096VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0136:*:*:*:*:*:*:*4.3.3.0136VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0154:*:*:*:*:*:*:*4.3.3.0154VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:*4.3.3.0174VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0188:*:*:*:*:*:*:*4.3.3.0188VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0210:*:*:*:*:*:*:*4.3.3.0210VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0229:*:*:*:*:*:*:*4.3.3.0229VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0238:*:*:*:*:*:*:*4.3.3.0238VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0262:*:*:*:*:*:*:*4.3.3.0262VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0299:*:*:*:*:*:*:*4.3.3.0299VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0351:*:*:*:*:*:*:*4.3.3.0351VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0353:*:*:*:*:*:*:*4.3.3.0353VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0361:*:*:*:*:*:*:*4.3.3.0361VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0369:*:*:*:*:*:*:*4.3.3.0369VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0378:*:*:*:*:*:*:*4.3.3.0378VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0396:*:*:*:*:*:*:*4.3.3.0396VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0404:*:*:*:*:*:*:*4.3.3.0404VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0416:*:*:*:*:*:*:*4.3.3.0416VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0418:*:*:*:*:*:*:*4.3.3.0418VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0448:*:*:*:*:*:*:*4.3.3.0448VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0514:*:*:*:*:*:*:*4.3.3.0514VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0546:*:*:*:*:*:*:*4.3.3.0546VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0570:*:*:*:*:*:*:*4.3.3.0570VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:*4.3.3.0868VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:*4.3.3.0998VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:*4.3.3.1051VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:*4.3.3.1098VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:*4.3.3.1161VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:*4.3.3.1252VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:*4.3.3.1315VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:*4.3.3.1386VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*4.3.4VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0358:*:*:*:*:*:*:*4.3.4.0358VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0358:beta1:*:*:*:*:*:*4.3.4.0358 beta1VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0370:*:*:*:*:*:*:*4.3.4.0370VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0370:beta1:*:*:*:*:*:*4.3.4.0370 beta1VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0372:*:*:*:*:*:*:*4.3.4.0372VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0372:beta1:*:*:*:*:*:*4.3.4.0372 beta1VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0374:*:*:*:*:*:*:*4.3.4.0374VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0374:beta1:*:*:*:*:*:*4.3.4.0374 beta1VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0387:*:*:*:*:*:*:*4.3.4.0387VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0387:beta2:*:*:*:*:*:*4.3.4.0387 beta2VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0411:*:*:*:*:*:*:*4.3.4.0411VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0416:*:*:*:*:*:*:*4.3.4.0416VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0427:*:*:*:*:*:*:*4.3.4.0427VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0434:*:*:*:*:*:*:*4.3.4.0434VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0435:*:*:*:*:*:*:*4.3.4.0435VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0451:*:*:*:*:*:*:*4.3.4.0451VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0483:*:*:*:*:*:*:*4.3.4.0483VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0486:*:*:*:*:*:*:*4.3.4.0486VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0506:*:*:*:*:*:*:*4.3.4.0506VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0516:*:*:*:*:*:*:*4.3.4.0516VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0526:*:*:*:*:*:*:*4.3.4.0526VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0551:*:*:*:*:*:*:*4.3.4.0551VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0557:*:*:*:*:*:*:*4.3.4.0557VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0561:*:*:*:*:*:*:*4.3.4.0561VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0569:*:*:*:*:*:*:*4.3.4.0569VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0593:*:*:*:*:*:*:*4.3.4.0593VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0597:*:*:*:*:*:*:*4.3.4.0597VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0604:*:*:*:*:*:*:*4.3.4.0604VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0899:*:*:*:*:*:*:*4.3.4.0899VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1029:*:*:*:*:*:*:*4.3.4.1029VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1082:*:*:*:*:*:*:*4.3.4.1082VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1190:*:*:*:*:*:*:*4.3.4.1190VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1282:*:*:*:*:*:*:*4.3.4.1282VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1368:*:*:*:*:*:*:*4.3.4.1368VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1417:*:*:*:*:*:*:*4.3.4.1417VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*4.3.6VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:*4.3.6.0895VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:*4.3.6.0907VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:*4.3.6.0923VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:*4.3.6.0944VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:*4.3.6.0959VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:*4.3.6.0979VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:*4.3.6.0993VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:*4.3.6.1013VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:*4.3.6.1033VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:*4.3.6.1070VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:*4.3.6.1154VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:*4.3.6.1218VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:*4.3.6.1263VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:*4.3.6.1286VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:*4.3.6.1333VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:*4.3.6.1411VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.1:-:*:*:*:*:*:*4.5.1VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.2:-:*:*:*:*:*:*4.5.2VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*before h4.5.1VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*h4.5.1VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.1:-:*:*:*:*:*:*h4.5.1VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*before c4.5.3VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c4.5.3:-:*:*:*:*:*:*c4.5.3VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c4.5.4:-:*:*:*:*:*:*c4.5.4VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* Versions 4.2.6 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0095:*:*:*:*:*:*:* Versions 4.3.3.0095 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0096:*:*:*:*:*:*:* Versions 4.3.3.0096 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0136:*:*:*:*:*:*:* Versions 4.3.3.0136 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0154:*:*:*:*:*:*:* Versions 4.3.3.0154 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:* Versions 4.3.3.0174 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0188:*:*:*:*:*:*:* Versions 4.3.3.0188 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0210:*:*:*:*:*:*:* Versions 4.3.3.0210 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0229:*:*:*:*:*:*:* Versions 4.3.3.0229 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0238:*:*:*:*:*:*:* Versions 4.3.3.0238 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0262:*:*:*:*:*:*:* Versions 4.3.3.0262 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0299:*:*:*:*:*:*:* Versions 4.3.3.0299 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0351:*:*:*:*:*:*:* Versions 4.3.3.0351 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0353:*:*:*:*:*:*:* Versions 4.3.3.0353 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0361:*:*:*:*:*:*:* Versions 4.3.3.0361 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0369:*:*:*:*:*:*:* Versions 4.3.3.0369 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0378:*:*:*:*:*:*:* Versions 4.3.3.0378 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0396:*:*:*:*:*:*:* Versions 4.3.3.0396 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0404:*:*:*:*:*:*:* Versions 4.3.3.0404 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0416:*:*:*:*:*:*:* Versions 4.3.3.0416 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0418:*:*:*:*:*:*:* Versions 4.3.3.0418 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0448:*:*:*:*:*:*:* Versions 4.3.3.0448 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0514:*:*:*:*:*:*:* Versions 4.3.3.0514 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0546:*:*:*:*:*:*:* Versions 4.3.3.0546 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0570:*:*:*:*:*:*:* Versions 4.3.3.0570 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:* Versions 4.3.3.0868 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:* Versions 4.3.3.0998 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:* Versions 4.3.3.1051 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:* Versions 4.3.3.1098 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:* Versions 4.3.3.1161 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:* Versions 4.3.3.1252 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:* Versions 4.3.3.1315 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:* Versions 4.3.3.1386 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0358:*:*:*:*:*:*:* Versions 4.3.4.0358 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0358:beta1:*:*:*:*:*:* Versions 4.3.4.0358 beta1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0370:*:*:*:*:*:*:* Versions 4.3.4.0370 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0370:beta1:*:*:*:*:*:* Versions 4.3.4.0370 beta1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0372:*:*:*:*:*:*:* Versions 4.3.4.0372 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0372:beta1:*:*:*:*:*:* Versions 4.3.4.0372 beta1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0374:*:*:*:*:*:*:* Versions 4.3.4.0374 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0374:beta1:*:*:*:*:*:* Versions 4.3.4.0374 beta1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0387:*:*:*:*:*:*:* Versions 4.3.4.0387 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0387:beta2:*:*:*:*:*:* Versions 4.3.4.0387 beta2 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0411:*:*:*:*:*:*:* Versions 4.3.4.0411 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0416:*:*:*:*:*:*:* Versions 4.3.4.0416 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0427:*:*:*:*:*:*:* Versions 4.3.4.0427 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0434:*:*:*:*:*:*:* Versions 4.3.4.0434 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0435:*:*:*:*:*:*:* Versions 4.3.4.0435 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0451:*:*:*:*:*:*:* Versions 4.3.4.0451 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0483:*:*:*:*:*:*:* Versions 4.3.4.0483 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0486:*:*:*:*:*:*:* Versions 4.3.4.0486 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0506:*:*:*:*:*:*:* Versions 4.3.4.0506 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0516:*:*:*:*:*:*:* Versions 4.3.4.0516 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0526:*:*:*:*:*:*:* Versions 4.3.4.0526 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0551:*:*:*:*:*:*:* Versions 4.3.4.0551 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0557:*:*:*:*:*:*:* Versions 4.3.4.0557 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0561:*:*:*:*:*:*:* Versions 4.3.4.0561 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0569:*:*:*:*:*:*:* Versions 4.3.4.0569 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0593:*:*:*:*:*:*:* Versions 4.3.4.0593 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0597:*:*:*:*:*:*:* Versions 4.3.4.0597 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0604:*:*:*:*:*:*:* Versions 4.3.4.0604 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0899:*:*:*:*:*:*:* Versions 4.3.4.0899 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1029:*:*:*:*:*:*:* Versions 4.3.4.1029 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1082:*:*:*:*:*:*:* Versions 4.3.4.1082 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1190:*:*:*:*:*:*:* Versions 4.3.4.1190 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1282:*:*:*:*:*:*:* Versions 4.3.4.1282 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1368:*:*:*:*:*:*:* Versions 4.3.4.1368 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1417:*:*:*:*:*:*:* Versions 4.3.4.1417 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:* Versions 4.3.6 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:* Versions 4.3.6.0895 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:* Versions 4.3.6.0907 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:* Versions 4.3.6.0923 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:* Versions 4.3.6.0944 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:* Versions 4.3.6.0959 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:* Versions 4.3.6.0979 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:* Versions 4.3.6.0993 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:* Versions 4.3.6.1013 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:* Versions 4.3.6.1033 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:* Versions 4.3.6.1070 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:* Versions 4.3.6.1154 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:* Versions 4.3.6.1218 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:* Versions 4.3.6.1263 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:* Versions 4.3.6.1286 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:* Versions 4.3.6.1333 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:* Versions 4.3.6.1411 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.1:-:*:*:*:*:*:* Versions 4.5.1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.2:-:*:*:*:*:*:* Versions 4.5.2 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions before h4.5.1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:* Versions h4.5.1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.1:-:*:*:*:*:*:* Versions h4.5.1 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* Versions before c4.5.3 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c4.5.3:-:*:*:*:*:*:* Versions c4.5.3 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c4.5.4:-:*:*:*:*:*:* Versions c4.5.4 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.5.2.1566 build 20210202, 4.5.1.1456 build 20201015, 4.3.6.1446 build 20200929, 4.3.4.1463 build 20201006, 4.3.3.1432 build 20201006, 4.2.6 build 20210327
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h4.5.1.1472 build 20201031
  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c4.5.4.1601 build 20210309, c4.5.3.1454 build 20201013

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-19942
  2. 2026-10-03 Alias added: GHSA-v5p8-3v95-73c8

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences