CVE-2020-2503

Summary

If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

Affected Software

VendorProductVersion RangeStatus
QNAP Systems Inc.QESunspecified < 2.1.1affected

Weaknesses

  • CWE-79: CWE-79 Cross-site Scripting (XSS)
  • CWE-80: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
  • CWE-749: CWE-749 Exposed Dangerous Method or Function

ADP Enrichment

CVE Program Container

Additional References

References