Cyber Resilience

CVE-2018-19957

Medium

Published: 10 September 2021

Published
10 September 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.0032 55.2th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2018-19957 is a medium-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Qnap Qts. Its CVSS base score is 6.1 (Medium).

Operationally, ranked in the top 44.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following…

more

versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later

CWE(s)
CWE-1021

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

qnap
qts
≤ 4.5.4.1715
qnap
quts hero
≤ h4.5.4.1771
qnap
qutscloud
≤ c4.5.6.1755

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References