Vulnerabilities > CVE-2018-19957 - Improper Restriction of Rendered UI Layers or Frames vulnerability in Qnap Qts, Quts Hero and Qutscloud

CVSS 6.1 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

qnap

CWE-1021

NVD

Published: 2021-09-10

Updated: 2021-09-23

Summary

A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later

Vulnerable Configurations

Part	Description	Count
OS	Qnap Qnap Qutscloud - Qnap Qutscloud C4.5.1 Qnap Qutscloud C4.5.1.1350 Qnap Qutscloud C4.5.2.1379 Qnap Qutscloud C4.5.3 Qnap Qutscloud C4.5.4 Qnap Qutscloud C4.5.6 Qnap Quts Hero - Qnap Quts Hero 4.5.4.2374 Qnap Quts Hero 5.0.1.2376 Qnap Quts Hero H4.5.0 Qnap Quts Hero H4.5.0.1279 Qnap Quts Hero H4.5.0.1308 Qnap Quts Hero H4.5.0.1352 Qnap Quts Hero H4.5.0.1409 Qnap Quts Hero H4.5.1 Qnap Quts Hero H4.5.1.1472 Qnap Quts Hero H4.5.1.1491 Qnap Quts Hero H4.5.1.1582 Qnap Quts Hero H4.5.2 Qnap Quts Hero H4.5.2.1638 Qnap Quts Hero H4.5.3 Qnap Quts Hero H4.5.4 Qnap QTS - Qnap QTS 4.0 Qnap QTS 4.0.3 Qnap QTS 4.1.0 Qnap QTS 4.1.1 Qnap QTS 4.1.4 Qnap QTS 4.2.0 Qnap QTS 4.2.1 Qnap QTS 4.2.2 Qnap QTS 4.2.3 Qnap QTS 4.2.4 Qnap QTS 4.2.6 Qnap QTS 4.3.1.0013 Qnap QTS 4.3.1.0023 Qnap QTS 4.3.2.0050 Qnap QTS 4.3.2.0060 Qnap QTS 4.3.2.0144 Qnap QTS 4.3.3 Qnap QTS 4.3.3.0095 Qnap QTS 4.3.3.0096 Qnap QTS 4.3.3.0136 Qnap QTS 4.3.3.0154 Qnap QTS 4.3.3.0174 Qnap QTS 4.3.3.0188 Qnap QTS 4.3.3.0210 Qnap QTS 4.3.3.0229 Qnap QTS 4.3.3.0238 Qnap QTS 4.3.3.0262 Qnap QTS 4.3.3.0299 Qnap QTS 4.3.3.0351 Qnap QTS 4.3.3.0353 Qnap QTS 4.3.3.0361 Qnap QTS 4.3.3.0369 Qnap QTS 4.3.3.0378 Qnap QTS 4.3.3.0396 Qnap QTS 4.3.3.0404 Qnap QTS 4.3.3.0416 Qnap QTS 4.3.3.0418 Qnap QTS 4.3.3.0448 Qnap QTS 4.3.3.0514 Qnap QTS 4.3.3.0546 Qnap QTS 4.3.3.0570 Qnap QTS 4.3.3.0868 Qnap QTS 4.3.3.0998 Qnap QTS 4.3.3.1051 Qnap QTS 4.3.3.1098 Qnap QTS 4.3.3.1161 Qnap QTS 4.3.3.1252 Qnap QTS 4.3.3.1315 Qnap QTS 4.3.3.1386 Qnap QTS 4.3.3.1432 Qnap QTS 4.3.3.1624 Qnap QTS 4.3.3.1677 Qnap QTS 4.3.3.1693 Qnap QTS 4.3.3.1799 Qnap QTS 4.3.3.1864 Qnap QTS 4.3.3.1945 Qnap QTS 4.3.3.2057 Qnap QTS 4.3.3.2211 Qnap QTS 4.3.3.2420 Qnap QTS 4.3.3.2644 Qnap QTS 4.3.3.2784 Qnap QTS 4.3.3.4132 Qnap QTS 4.3.4 Qnap QTS 4.3.4.0358 Qnap QTS 4.3.4.0370 Qnap QTS 4.3.4.0372 Qnap QTS 4.3.4.0374 Qnap QTS 4.3.4.0387 Qnap QTS 4.3.4.0411 Qnap QTS 4.3.4.0416 Qnap QTS 4.3.4.0427 Qnap QTS 4.3.4.0434 Qnap QTS 4.3.4.0435 Qnap QTS 4.3.4.0451 Qnap QTS 4.3.4.0483 Qnap QTS 4.3.4.0486 Qnap QTS 4.3.4.0506 Qnap QTS 4.3.4.0516 Qnap QTS 4.3.4.0526 Qnap QTS 4.3.4.0551 Qnap QTS 4.3.4.0557 Qnap QTS 4.3.4.0561 Qnap QTS 4.3.4.0569 Qnap QTS 4.3.4.0593 Qnap QTS 4.3.4.0597 Qnap QTS 4.3.4.0604 Qnap QTS 4.3.4.0899 Qnap QTS 4.3.4.1029 Qnap QTS 4.3.4.1082 Qnap QTS 4.3.4.1190 Qnap QTS 4.3.4.1282 Qnap QTS 4.3.4.1368 Qnap QTS 4.3.4.1417 Qnap QTS 4.3.4.1463 Qnap QTS 4.3.4.1632 Qnap QTS 4.3.4.1652 Qnap QTS 4.3.4.1976 Qnap QTS 4.3.4.2107 Qnap QTS 4.3.4.2242 Qnap QTS 4.3.4.2451 Qnap QTS 4.3.4.2675 Qnap QTS 4.3.4.2814 Qnap QTS 4.3.5 Qnap QTS 4.3.6 Qnap QTS 4.3.6.0895 Qnap QTS 4.3.6.0907 Qnap QTS 4.3.6.0923 Qnap QTS 4.3.6.0944 Qnap QTS 4.3.6.0959 Qnap QTS 4.3.6.0979 Qnap QTS 4.3.6.0993 Qnap QTS 4.3.6.1013 Qnap QTS 4.3.6.1033 Qnap QTS 4.3.6.1070 Qnap QTS 4.3.6.1154 Qnap QTS 4.3.6.1218 Qnap QTS 4.3.6.1263 Qnap QTS 4.3.6.1286 Qnap QTS 4.3.6.1333 Qnap QTS 4.3.6.1411 Qnap QTS 4.3.6.1446 Qnap QTS 4.3.6.1620 Qnap QTS 4.3.6.1663 Qnap QTS 4.3.6.1711 Qnap QTS 4.3.6.1750 Qnap QTS 4.3.6.1831 Qnap QTS 4.3.6.1907 Qnap QTS 4.3.6.1965 Qnap QTS 4.3.6.2050 Qnap QTS 4.3.6.2232 Qnap QTS 4.3.6.2441 Qnap QTS 4.3.6.2665 Qnap QTS 4.3.6.2805 Qnap QTS 4.4.0 Qnap QTS 4.4.0.0883 Qnap QTS 4.4.0.0931 Qnap QTS 4.4.0.0979 Qnap QTS 4.4.1 Qnap QTS 4.4.1.0948 Qnap QTS 4.4.1.0949 Qnap QTS 4.4.1.0978 Qnap QTS 4.4.1.0998 Qnap QTS 4.4.1.0999 Qnap QTS 4.4.1.1031 Qnap QTS 4.4.1.1033 Qnap QTS 4.4.1.1064 Qnap QTS 4.4.1.1081 Qnap QTS 4.4.1.1086 Qnap QTS 4.4.1.1101 Qnap QTS 4.4.1.1117 Qnap QTS 4.4.1.1146 Qnap QTS 4.4.1.1201 Qnap QTS 4.4.1.1216 Qnap QTS 4.4.1.1261 Qnap QTS 4.4.2 Qnap QTS 4.4.2.1231 Qnap QTS 4.4.2.1270 Qnap QTS 4.4.3 Qnap QTS 4.4.3.1354 Qnap QTS 4.4.3.1381 Qnap QTS 4.4.3.1400 Qnap QTS 4.4.3.1421 Qnap QTS 4.4.3.1439 Qnap QTS 4.4.3.1444 Qnap QTS 4.5.1 Qnap QTS 4.5.1.1456 Qnap QTS 4.5.1.1461 Qnap QTS 4.5.1.1465 Qnap QTS 4.5.1.1480 Qnap QTS 4.5.1.1495 Qnap QTS 4.5.1.1540 Qnap QTS 4.5.2 Qnap QTS 4.5.2.1566 Qnap QTS 4.5.2.1594 Qnap QTS 4.5.2.1630 Qnap QTS 4.5.3 Qnap QTS 4.5.3.1652 Qnap QTS 4.5.3.1670 Qnap QTS 4.5.3.1697 Qnap QTS 4.5.4	345

Common Weakness Enumeration (CWE)

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

References

https://www.qnap.com/en/security-advisory/qsa-21-03