by Kastro
Paper/Archive/CVE-2024-38645

CVE-2024-38645

QNAP Systems Inc. Notes Station 3 — Notes Station 3

EPSS 0.6%CVSS 9.4
critical.is priorityof 100
38
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 49.8.498 × 2010.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to read application data. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later

Affected

ProductAffectedFixed inSource
Notes Station 33.9.x – < 3.9.73.9.7CNA
notes_station_33.9.0 – < 3.9.73.9.7CISA-ADP

Scores by source

qnap (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refqnap.com/en/security-advisory/qsa-24-36