CVE-2018-19953

Timeline

Detection, updates, and resolution for this record.

1. Oct 28, 2020 · Catalog

   Detected

   If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

2. May 24, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jun 14, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Oct 1, 2026 · Catalog

   Updated

   If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Affected

• cpe qnap/qtsversion unspecified
• cpe qnap/qts4.2.6
• vendor QNAP Network Attached Storage (NAS)version unspecified

Sources

• CISA KEVCVE-2018-19953

  A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

  cisa.gov
• CVE.orgCVE-2018-19953

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2018-19953

  30-day exploitation probability 29.0%

  first.org
• NIST NVDCVE-2018-19953

  If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · qnap.com