SB2019122502 - Multiple vulnerabilities in QNAP Systems QTS and Photo Station
Published: December 25, 2019 Updated: May 20, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Externally Controlled Reference to a Resource in Another Sphere (CVE-ID: CVE-2019-7195)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected software uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. A remote attacker can access or modify system files.
2) Externally Controlled Reference to a Resource in Another Sphere (CVE-ID: CVE-2019-7194)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected software uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. A remote attacker can access or modify system files.
3) Input validation error (CVE-ID: CVE-2019-7193)
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and execute arbitrarycode on the target system.
4) Improper access control (CVE-ID: CVE-2019-7192)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.
Remediation
Install update from vendor's website.