Read the docs
TI-2021-13396 Aliases CVE-2021-34357GHSA-gfgx-cxc3-v57c

Reflected XSS Vulnerability in QmailAgent

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later

Why it matters now

EPSS 0.00712 53rd percentileScored 2026-11-07
Fix Fixed QmailAgent (QNAP Systems Inc.): 3.0.2 ( 2021/08/25 )

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQmailAgentbefore 3.0.2 ( 2021/08/25 )3.0.2 ( 2021/08/25 )Patch availableCNA
  • QmailAgent VendorQNAP Affected before 3.0.2 ( 2021/08/25 ) Fixed in 3.0.2 ( 2021/08/25 ) Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:qnap:qmailagent:*:*:*:*:*:*:*:*before 3.0.2VulnerableQNAP
cpe:2.3:h:qnap:nas:-:*:*:*:*:*:*:*not specified by NVDRunning onQNAP
  • cpe:2.3:a:qnap:qmailagent:*:*:*:*:*:*:*:* Versions before 3.0.2 Vulnerable ·QNAP
  • cpe:2.3:h:qnap:nas:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·QNAP

Remediation

  • Fix · CNA QmailAgent (QNAP Systems Inc.) Fixed in 3.0.2 ( 2021/08/25 )

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-34357
  2. 2026-10-03 Alias added: GHSA-gfgx-cxc3-v57c

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences