title: DOM-Based XSS Vulnerability in QTS and QuTS hero
description: A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 4.5.3.1652 Build 20210428, status: affected, version: unspecified, versionType: custom
status: unaffected, version: 4.3.6
status: unaffected, version: 4.3.3
}
{
product: QuTS hero
vendor: QNAP Systems Inc.
versions:
lessThan: h4.5.2.1638 Build 20210414, status: affected, version: unspecified, versionType: custom
}
{
product: QuTScloud
vendor: QNAP Systems Inc.
versions:
lessThan: c4.5.5.1656 Build 20210503, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: QNAP have already fixed this vulnerability in the following versions:
QTS 4.5.3.1652 Build 20210428 and later
QuTS hero h4.5.2.1638 Build 20210414 and later
QuTScloud c4.5.5.1656 Build 20210503 and later