Read the docs
TI-2020-02210 Aliases CVE-2020-2498GHSA-m7vg-3vj5-h86f

Cross-site scripting vulnerability in QTS and QuTS hero

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later

Why it matters now

EPSS 0.00603 49th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.5.1.1456, 4.4.3.1354, 4.3.6.1333 +3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTSbefore 4.5.1.1456; before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.64.5.1.1456, 4.4.3.1354, 4.3.6.1333, 4.3.4.1368, 4.3.3.1315, 4.2.6Patch availableCNA
QNAPQuTS hero< h4.5.1.1472—No fix listedCNA
  • QTS VendorQNAP Affected before 4.5.1.1456; before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6 Fixed in 4.5.1.1456, 4.4.3.1354, 4.3.6.1333, 4.3.4.1368, 4.3.3.1315, 4.2.6 Patch available CNA
  • QuTS hero VendorQNAP Affected < h4.5.1.1472 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*before h4.5.1.1472VulnerableQNAP
cpe:2.3:a:qnap:qts:*:*:*:*:*:*:*:*before 4.5.1.1456VulnerableQNAP
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6VulnerableQNAP
  • cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions before h4.5.1.1472 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.5.1.1456 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.5.1.1456, 4.4.3.1354, 4.3.6.1333, 4.3.4.1368, 4.3.3.1315, 4.2.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-2498
  2. 2026-10-03 Alias added: GHSA-m7vg-3vj5-h86f

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences