OpenCVE

A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Complete

AV:N/AC:L/Au:N/C:N/I:P/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Qnap	Qts

Configuration 1 [-]

OR	cpe:2.3:o:qnap:qts::::::::
	cpe:2.3:o:qnap:qts::::::::

No data.

References

Link	Providers
https://www.qnap.com/zh-tw/security-advisory/qsa-20-21

History

No history.

MITRE

Status: PUBLISHED

Assigner: qnap

Published: 2020-12-31T16:33:27.917070Z

Updated: 2024-09-17T02:01:35.778Z

Reserved: 2018-12-07T00:00:00

Link: CVE-2018-19945

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-12-31T17:15:12.510

Modified: 2024-11-21T03:58:51.720

Link: CVE-2018-19945

Redhat

No data.

{"containers": {"cna": {"affected": [{"platforms": ["build 20190328"], "product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "4.3.6.0895", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["build 20190322"], "product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "4.3.4.0899", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"status": "unaffected", "version": "4.5.x"}, {"status": "unaffected", "version": "4.4.x"}]}], "credits": [{"lang": "en", "value": "Independent Security Evaluators"}], "datePublic": "2020-12-30T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "description": "CWE-73 External Control of File Name or Path", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-12-31T16:33:27", "orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-21"}], "solutions": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions:\n\nQTS 4.3.6.0895 build 20190328 (and later)\nQTS 4.3.4.0899 build 20190322 (and later)\nThis issue does not affect QTS 4.4.x or QTS 4.5.x."}], "source": {"advisory": "QSA-20-21", "discovery": "EXTERNAL"}, "title": "Improper Limitation of a Pathname to a Restricted Directory in QTS", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@qnap.com", "DATE_PUBLIC": "2020-12-30T02:55:00.000Z", "ID": "CVE-2018-19945", "STATE": "PUBLIC", "TITLE": "Improper Limitation of a Pathname to a Restricted Directory in QTS"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "QTS", "version": {"version_data": [{"platform": "build 20190328", "version_affected": "<", "version_value": "4.3.6.0895"}, {"platform": "build 20190322", "version_affected": "<", "version_value": "4.3.4.0899"}, {"version_affected": "!", "version_value": "4.5.x"}, {"version_affected": "!", "version_value": "4.4.x"}]}}]}, "vendor_name": "QNAP Systems Inc."}]}}, "credit": [{"lang": "eng", "value": "Independent Security Evaluators"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20 Improper Input Validation"}]}, {"description": [{"lang": "eng", "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"description": [{"lang": "eng", "value": "CWE-73 External Control of File Name or Path"}]}, {"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-21", "refsource": "MISC", "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-21"}]}, "solution": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions:\n\nQTS 4.3.6.0895 build 20190328 (and later)\nQTS 4.3.4.0899 build 20190322 (and later)\nThis issue does not affect QTS 4.4.x or QTS 4.5.x."}], "source": {"advisory": "QSA-20-21", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T11:51:17.544Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-21"}]}]}, "cveMetadata": {"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "assignerShortName": "qnap", "cveId": "CVE-2018-19945", "datePublished": "2020-12-31T16:33:27.917070Z", "dateReserved": "2018-12-07T00:00:00", "dateUpdated": "2024-09-17T02:01:35.778Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E35BB2A-1E3B-4D5C-B6E0-357D430D0C68", "versionEndExcluding": "4.3.4.0899", "versionStartIncluding": "4.3.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D099A53-6729-43B2-B762-873BCDC0C354", "versionEndExcluding": "4.3.6.0895", "versionStartIncluding": "4.3.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x."}, {"lang": "es", "value": "Se ha reportado de una vulnerabilidad que afecta a los dispositivos QNAP anteriores que ejecutan QTS versi\u00f3n 4.3.4 a la 4.3.6. Causada por limitaciones inapropiadas de un nombre de ruta en un directorio restringido, esta vulnerabilidad permite cambiar el nombre de archivos arbitrarios en el sistema de destino, si se explota. QNAP ya ha corregido esta vulnerabilidad en las siguientes versiones: QTS versi\u00f3n 4.3.6.0895 build 20190328 (y posterior) QTS versi\u00f3n 4.3.4.0899 build 20190322 (y posterior) Este problema no afecta a QTS versi\u00f3n 4.4.x o QTS versi\u00f3n 4.5.x."}], "id": "CVE-2018-19945", "lastModified": "2024-11-21T03:58:51.720", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 8.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 7.8, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-31T17:15:12.510", "references": [{"source": "security@qnapsecurity.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-21"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-21"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-284"}], "source": "security@qnapsecurity.com.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}