CVE-2018-0722 - OpenCVE

Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Qnap	Photo Station Qts

Configuration 1 [-]

AND

cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*

cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*

cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*

cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.qnap.com/zh-tw/security-advisory/nas-201901-14

History

No history.

MITRE

Status: PUBLISHED

Assigner: qnap

Published: 2019-02-01T18:00:00Z

Updated: 2024-09-16T21:56:56.471Z

Reserved: 2017-11-28T00:00:00

Link: CVE-2018-0722

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2019-02-01T18:29:00.317

Modified: 2019-02-12T21:04:25.740

Link: CVE-2018-0722

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Photo Station", "vendor": "QNAP", "versions": [{"status": "affected", "version": "Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6"}]}], "datePublic": "2019-01-14T00:00:00", "descriptions": [{"lang": "en", "value": "Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device."}], "problemTypes": [{"descriptions": [{"description": "Path Traversal", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-02-01T17:57:01", "orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201901-14"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@qnap.com", "DATE_PUBLIC": "2019-01-14T00:00:00", "ID": "CVE-2018-0722", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Photo Station", "version": {"version_data": [{"version_value": "Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6"}]}}]}, "vendor_name": "QNAP"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Path Traversal"}]}]}, "references": {"reference_data": [{"name": "https://www.qnap.com/zh-tw/security-advisory/nas-201901-14", "refsource": "CONFIRM", "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201901-14"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:35:49.238Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201901-14"}]}]}, "cveMetadata": {"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "assignerShortName": "qnap", "cveId": "CVE-2018-0722", "datePublished": "2019-02-01T18:00:00Z", "dateReserved": "2017-11-28T00:00:00", "dateUpdated": "2024-09-16T21:56:56.471Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "F0C7D2D4-769F-4297-89F4-75366FFA7618", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CD13101-CCC2-431B-B06B-67D78B560D06", "versionEndIncluding": "5.7.2", "versionStartIncluding": "5.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B24D5D0-F9B1-4B7B-ADE3-BEA55177EB46", "versionEndIncluding": "5.4.4", "versionStartIncluding": "5.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "1D9E6F8F-A433-45A7-8839-5D478FE179A4", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*", "matchCriteriaId": "77E64ACC-1BAB-4F43-8E4D-3CC35715483C", "versionEndIncluding": "5.2.8", "versionStartIncluding": "5.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device."}, {"lang": "es", "value": "Existe una vulnerabilidad de salto de directorio en las siguientes versiones de Photo Station que podr\u00eda permitir a los atacantes remotos acceder a informaci\u00f3n sensible en el dispositivo: 5.72 y anteriores en QTS 4.3.4, 5.44 y anteriores en QTS 4.3.3 y 5.28 y anteriores en QTS 4.2.6."}], "id": "CVE-2018-0722", "lastModified": "2019-02-12T21:04:25.740", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-02-01T18:29:00.317", "references": [{"source": "security@qnapsecurity.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201901-14"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}