title: Reflected XSS in Kazoo Server
description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.20 and later
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Kazoo Server
vendor: Linn Products Limited
versions:
lessThan: 4.11.20, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: We have already fixed this vulnerability in the following versions of Kazoo Server:
Kazoo Server 4.11.20 and later