title: CSRF Bypass in Proxy Server
description: A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later QuTScloud c4.5.6: Proxy Server 1.4.2 ( 2021/12/30 ) and later
problem types: CWE-352
affected:
{
platforms: QTS 4.5.x
product: Proxy Server
vendor: QNAP Systems Inc.
versions:
lessThan: 1.4.2 ( 2021/12/30 ), status: affected, version: unspecified, versionType: custom
}
{
platforms: QuTS hero h5.0.0
product: Proxy Server
vendor: QNAP Systems Inc.
versions:
lessThan: 1.4.3 ( 2022/01/18 ), status: affected, version: unspecified, versionType: custom
}
{
platforms: QuTScloud c4.5.6
product: Proxy Server
vendor: QNAP Systems Inc.
versions:
lessThan: 1.4.2 ( 2021/12/30 ), status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: We have already fixed this vulnerability in the following versions of Proxy Server:
QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later
QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later
QuTScloud c4.5.6: Proxy Server 1.4.2 ( 2021/12/30 ) and later