Read the docs
TI-2023-20445 Aliases CVE-2023-39301GHSA-6295-9vm4-27hw

Server-side request forgery in QNAP QTS

Priority LOW 20CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 34th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.0.1.2514 build 20230906, 5.1.1.2491 build 20230815QuTS hero (QNAP Systems Inc.): h5.0.1.2515 build 20230907, h5.1.1.2488 build 20230812+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS5.0.x to before 5.0.1.2514 build 20230906; 5.1.x to before 5.1.1.2491 build 202308155.0.1.2514 build 20230906, 5.1.1.2491 build 20230815Patch availableCNA
QNAPQuTS heroh5.0.x to before h5.0.1.2515 build 20230907; h5.1.x to before h5.1.1.2488 build 20230812h5.0.1.2515 build 20230907, h5.1.1.2488 build 20230812Patch availableCNA
QNAPQuTScloudc5.x.x to before c5.1.0.2498c5.1.0.2498Patch availableCNA
  • QTS VendorQNAP Affected 5.0.x to before 5.0.1.2514 build 20230906; 5.1.x to before 5.1.1.2491 build 20230815 Fixed in 5.0.1.2514 build 20230906, 5.1.1.2491 build 20230815 Patch available CNA
  • QuTS hero VendorQNAP Affected h5.0.x to before h5.0.1.2515 build 20230907; h5.1.x to before h5.1.1.2488 build 20230812 Fixed in h5.0.1.2515 build 20230907, h5.1.1.2488 build 20230812 Patch available CNA
  • QuTScloud VendorQNAP Affected c5.x.x to before c5.1.0.2498 Fixed in c5.1.0.2498 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*before 5.1.1.2491; before 5.0.1.2514VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*before h5.1.1.2488; before h5.0.1.2515VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*before c5.1.0.2498VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 5.1.1.2491; before 5.0.1.2514 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions before h5.1.1.2488; before h5.0.1.2515 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* Versions before c5.1.0.2498 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.0.1.2514 build 20230906, 5.1.1.2491 build 20230815
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.0.1.2515 build 20230907, h5.1.1.2488 build 20230812
  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.1.0.2498

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-39301
  2. 2026-10-03 Alias added: GHSA-6295-9vm4-27hw

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences