6.1med
CVE-2018-19957
Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud
Published 5 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known
Summary
A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later
Exploit prediction (EPSS)
0.71% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QuTScloud
Classification
- Weakness
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames
References
- qnap.com /en/security-advisory/qsa-21-03 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-19957
- NVD: CVE-2018-19957
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.