CVE-2021-34360

MEDIUM

QNAP NAS Proxy Server 1.4.0-1.4.1 - Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later QuTScloud c4.5.6: Proxy Server 1.4.2 ( 2021/12/30 ) and later

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://www.qnap.com/en/security-advisory/qsa-22-18

Scores

CVSS v3 5.3
EPSS 0.0009
EPSS Percentile 24.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-352
Status published
Products (1)
qnap/nas_proxy_server 1.4.0 - 1.4.2
Published May 26, 2022
Tracked Since Feb 18, 2026