CVE-2023-51364

Deeper analysis

A path traversal vulnerability tracked as CVE-2023-51364 affects multiple versions of QNAP QTS, QuTS hero, and QuTScloud operating systems. Classified under CWE-22, the flaw allows an attacker to read the contents of files outside expected directories, exposing sensitive data over the network. It carries a CVSS 3.1 score of 8.7 with the vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H.

Remote unauthenticated attackers can exploit the issue across the network, although the high attack-complexity requirement applies. Successful exploitation can result in integrity and availability impacts with changed scope, while the confidentiality impact is rated as none in the CVSS assessment.

QNAP's security advisory QSA-24-14 states that the vulnerability has been addressed in QTS 5.1.4.2596 build 20231128 and later, QTS 4.5.4.2627 build 20231225 and later, QuTS hero h5.1.3.2578 build 20231110 and later, QuTS hero h4.5.4.2626 build 20231225 and later, and QuTScloud c5.1.5.2651 and later. The current EPSS score of 0.1109, with a peak of 0.1136, indicates moderate exploitation probability without evidence of a sharp post-disclosure rise.