CVE-2020-36195
Published: Apr 17, 2021
Modified: Sep 16, 2024
CVSS v3.1
9.8
Description
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later
| Vendor | Product | Versions |
|---|---|---|
QNAP Systems Inc. | QTS | affected unspecified - < 4.3.3.1624 Build 20210416affected unspecified - < 4.3.6.1620 Build 20210322 |
QNAP Systems Inc. | Media Streaming add-on | affected unspecified - < 430.1.8.10affected unspecified - < 430.1.8.8 |
QNAP Systems Inc. | Multimedia Console | affected unspecified - < 1.3.4 |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now