CVE-2018-19941 - Vulnerability Details - OpenCVE

A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Qnap	Qts Quts Hero Qutscloud

Configuration 1 [-]

OR	cpe:2.3:o:qnap:qts::::::::
	cpe:2.3:o:qnap:quts_hero::::::::
	cpe:2.3:o:qnap:qutscloud::::::::

No data.

References

Link	Providers
https://www.qnap.com/zh-tw/security-advisory/qsa-20-23

History

No history.

MITRE

Status: PUBLISHED

Assigner: qnap

Published: 2020-12-31T16:33:27.622856Z

Updated: 2024-09-16T23:50:48.219Z

Reserved: 2018-12-07T00:00:00

Link: CVE-2018-19941

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-12-31T17:15:12.320

Modified: 2024-11-21T03:58:51.163

Link: CVE-2018-19941

Redhat

No data.

{"containers": {"cna": {"affected": [{"platforms": ["build 20201031"], "product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "4.5.1.1456", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["build 20201031"], "product": "QuTS hero", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "h4.5.1.1472", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["build 20200730"], "product": "QuTScloud", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "c4.5.2.1379", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Independent Security Evaluators"}], "datePublic": "2020-12-30T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-315", "description": "CWE-315 Cleartext Storage of Sensitive Information in a Cookie", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-12-31T16:33:27", "orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-23"}], "solutions": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions:\n\nQTS 4.5.1.1456 build 20201015 (and later)\nQuTS hero h4.5.1.1472 build 20201031 (and later)\nQuTScloud c4.5.2.1379 build 20200730 (and later)"}], "source": {"advisory": "QSA-20-23", "discovery": "EXTERNAL"}, "title": "Cleartext Storage of Sensitive Information in Cookies", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@qnap.com", "DATE_PUBLIC": "2020-12-30T02:55:00.000Z", "ID": "CVE-2018-19941", "STATE": "PUBLIC", "TITLE": "Cleartext Storage of Sensitive Information in Cookies"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "QTS", "version": {"version_data": [{"platform": "build 20201031", "version_affected": "<", "version_value": "4.5.1.1456"}]}}, {"product_name": "QuTS hero", "version": {"version_data": [{"platform": "build 20201031", "version_affected": "<", "version_value": "h4.5.1.1472"}]}}, {"product_name": "QuTScloud", "version": {"version_data": [{"platform": "build 20200730", "version_affected": "<", "version_value": "c4.5.2.1379"}]}}]}, "vendor_name": "QNAP Systems Inc."}]}}, "credit": [{"lang": "eng", "value": "Independent Security Evaluators"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-315 Cleartext Storage of Sensitive Information in a Cookie"}]}]}, "references": {"reference_data": [{"name": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-23", "refsource": "MISC", "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-23"}]}, "solution": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions:\n\nQTS 4.5.1.1456 build 20201015 (and later)\nQuTS hero h4.5.1.1472 build 20201031 (and later)\nQuTScloud c4.5.2.1379 build 20200730 (and later)"}], "source": {"advisory": "QSA-20-23", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T11:51:17.772Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-23"}]}]}, "cveMetadata": {"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "assignerShortName": "qnap", "cveId": "CVE-2018-19941", "datePublished": "2020-12-31T16:33:27.622856Z", "dateReserved": "2018-12-07T00:00:00", "dateUpdated": "2024-09-16T23:50:48.219Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DF58F11-5E71-4EFB-8039-B4EA21C2C810", "versionEndExcluding": "4.5.1.1456", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE137056-C682-4DF3-839E-2E5825F21485", "versionEndExcluding": "h4.5.1.1472", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "48C09CC6-23EB-45B4-B289-45C6C4AC9BB9", "versionEndExcluding": "c4.5.2.1379", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)"}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad que afecta a QNAP NAS. Si se explota, esta vulnerabilidad permite a un atacante acceder a informaci\u00f3n confidencial almacenada en texto plano dentro de las cookies por medio de determinadas herramientas ampliamente disponibles. QNAP ya ha corregido esta vulnerabilidad en las siguientes versiones: QTS versiones 4.5.1.1456 build 20201015 (y posteriores) QuTS hero versi\u00f3n h4.5.1.1472 build 20201031 (y posteriores) QuTScloud versi\u00f3n c4.5.2.1379 build 20200730 (y posteriores)"}], "id": "CVE-2018-19941", "lastModified": "2024-11-21T03:58:51.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-31T17:15:12.320", "references": [{"source": "security@qnapsecurity.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-23"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-23"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-315"}], "source": "security@qnapsecurity.com.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Primary"}]}