by Kastro
Paper/Archive/CVE-2020-2503

CVE-2020-2503

QNAP Systems Inc. QES — Stored cross-site scripting vulnerability in QES

EPSS 0.8%CVSS 9.0
critical.is priorityof 100
38
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 56.3.563 × 2011.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

Affected

ProductAffectedFixed inSource
QESunspecified – < 2.1.12.1.1CNA

Scores by source

qnap (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

refqnap.com/zh-tw/security-advisory/qsa-20-17