CVE-2018-19943

Deeper analysis

CVE-2018-19943 is a cross-site scripting vulnerability, tracked under CWE-79 and CWE-80, that affects multiple versions of QNAP QTS prior to the listed fixed builds. Successful exploitation permits remote attackers to inject malicious code into the affected NAS operating system.

An attacker with low privileges can leverage the flaw over the network, though the attack requires high complexity, user interaction, and results in changed scope; the CVSS 3.1 score of 8.0 reflects high impact on confidentiality, integrity, and availability. The vulnerability enables injection of arbitrary scripts that execute in the context of other users or sessions.

QNAP security advisory QSA-20-01 states that the issues have been resolved in QTS 4.4.2.1270 build 20200410 and later, 4.4.1.1261 build 20200330 and later, 4.3.6.1263 build 20200330 and later, 4.3.4.1282 build 20200408 and later, 4.3.3.1252 build 20200409 and later, and 4.2.6 build 20200421 and later. The vulnerability appears in the CISA Known Exploited Vulnerabilities catalog, indicating confirmed real-world exploitation.