ZeroDay Findings
Sign inSign up

Findings

CVE-2018-19953

QNAP NAS File Station Cross-Site Scripting Vulnerability

Published Oct 28, 2020 · updated Oct 1, 2026 · qnap qts

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 28, 2020 · Catalog

    Detected

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

  2. May 24, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 14, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Oct 1, 2026 · Catalog

    Updated

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Required action

Apply updates per vendor instructions.

CISA due date Jun 14, 2022

Affected

  • cpe qnap/qtsversion unspecified
  • cpe qnap/qts4.2.6
  • vendor QNAP Network Attached Storage (NAS)version unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2018-19953

    A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2018-19953

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2018-19953

    30-day exploitation probability 29.0%

    first.org
  • NIST NVDVulnerability recordCVE-2018-19953

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4

    nvd.nist.gov

References