title: Reflected XSS Vulnerability in TFTP
description: A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: QuTS hero
vendor: QNAP Systems Inc.
versions:
lessThan: h4.5.4.1771 build 20210825, status: affected, version: unspecified, versionType: custom
}
{
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 4.5.4.1787 build 20210910, status: affected, version: unspecified, versionType: custom
}
{
product: QuTScloud
vendor: QNAP Systems Inc.
versions:
lessThan: c4.5.7.1864, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
]
solutions: We have already fixed this vulnerability in the following versions of QuTS hero, QTS, QuTScloud:
QuTS hero h4.5.4.1771 build 20210825 and later
QTS 4.5.4.1787 build 20210910 and later
QuTScloud c4.5.7.1864 and later