by Kastro
Paper/Archive/CVE-2020-2500

CVE-2020-2500

QNAP Systems Inc. Helpdesk — This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service.

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.8.548 × 2011.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.

Affected

ProductAffectedFixed inSource
Helpdeskunspecified – < 3.0.13.0.1CNA

Scores by source

qnap (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refqnap.com/zh-tw/security-advisory/qsa-20-03