Read the docs
TI-2018-14131 Aliases CVE-2018-19943GHSA-wh89-fj9h-4gr8

Cross-site scripting in QNAP QTS

Priority CRITICAL 94Exploited in the wildCWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Why it matters now

Exploitation Active In CISA KEV since 2022-05-24CISA due date 2022-06-14Known ransomware use
EPSS 0.22682 97th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.4.2.1270, 4.4.1.1261, 4.3.6.1263 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTSbefore 4.4.2.12704.4.2.1270Patch availableCNA
QNAPQTSbefore 4.4.1.1261; before 4.3.6.12634.4.1.1261, 4.3.6.1263Patch availableCNA
QNAPQTSbefore 4.3.4.12824.3.4.1282Patch availableCNA
QNAPQTSbefore 4.3.3.12524.3.3.1252Patch availableCNA
QNAPQTSbefore 4.2.64.2.6Patch availableCNA
  • QTS VendorQNAP Affected before 4.4.2.1270 Fixed in 4.4.2.1270 Patch available CNA
  • QTS VendorQNAP Affected before 4.4.1.1261; before 4.3.6.1263 Fixed in 4.4.1.1261, 4.3.6.1263 Patch available CNA
  • QTS VendorQNAP Affected before 4.3.4.1282 Fixed in 4.3.4.1282 Patch available CNA
  • QTS VendorQNAP Affected before 4.3.3.1252 Fixed in 4.3.3.1252 Patch available CNA
  • QTS VendorQNAP Affected before 4.2.6 Fixed in 4.2.6 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*before 4.2.6; 4.3.1.0013 to before 4.3.3.1252; 4.3.4 to before 4.3.4.1282; 4.3.6 to before 4.3.6.1263; 4.4.0 to before 4.4.1.1261; 4.4.2 to before 4.4.2.1270VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*4.2.6VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*4.2.6 build_20170517VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*4.2.6 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*4.2.6 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*4.2.6 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*4.2.6 build_20191107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*4.2.6 build_20200109VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*4.2.6 build_20200421VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*4.2.6 build_20200611VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.2.6; 4.3.1.0013 to before 4.3.3.1252; 4.3.4 to before 4.3.4.1282; 4.3.6 to before 4.3.6.1263; 4.4.0 to before 4.4.1.1261; 4.4.2 to before 4.4.2.1270 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* Versions 4.2.6 build_20200109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* Versions 4.2.6 build_20200421 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* Versions 4.2.6 build_20200611 Vulnerable ·QNAP
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*4.2.6 build_20200821VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* Versions 4.2.6 build_20200821 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.4.2.1270
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.4.1.1261, 4.3.6.1263
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.4.1282
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.3.1252
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.2.6

Timeline

  1. 2022-05-24 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2018-19943
  3. 2026-10-03 Alias added: GHSA-wh89-fj9h-4gr8

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14141 Cross-site scripting in QNAP QTS KEVCVSS 3.1MEDIUM 6.1
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences