CVE-2024-21901mediumCWE-89

CVE-2024-21901: medium-severity vulnerability in QNAP Systems Inc. myQNAPcloud

myQNAPcloud

Published · Updated

Follow this CVE+ Monitor QTS+ Monitor myQNAPcloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.7epss 19%
In short

A SQL injection flaw in myQNAPcloud allows authenticated administrators to insert malicious SQL commands through the network, potentially compromising the database and system data.

Technical detail

SQL injection vulnerability in myQNAPcloud accessible to authenticated administrators via network input; exploitation requires valid admin credentials and allows arbitrary SQL query execution, impacting data confidentiality and integrity. Fixed in myQNAPcloud 1.0.52 and QTS 4.5.4.2627 build 20231225 or later.

Summary generated and translated by AI from the official description.
A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 ( 2023/11/24 ) and later QTS 4.5.4.2627 build 20231225 and later
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected products
QNAP Systems Inc. · myQNAPcloudQNAP Systems Inc. · QTS
Related CVEs — QNAP Systems Inc. myQNAPcloud

In the same product, most dangerous first.

CVE-2020-2509CRITICALCommand Injection Vulnerability in QTS and QuTS heroEPSS 34.0%KEVCVE-2018-19953MEDIUMCVE-2018-19953EPSS 30.5%KEVCVE-2018-19949CRITICALCVE-2018-19949EPSS 30.2%KEVCVE-2018-19943HIGHCVE-2018-19943EPSS 22.7%KEVCVE-2023-47218MEDIUMQTS, QuTS hero, QuTScloudEPSS 89.9%CVE-2023-51364HIGHQTS, QuTS hero, QuTScloudEPSS 39.7%