CVE-2021-38681
Reflected XSS Vulnerability in Ragic Cloud DB
Severity Score
5.4
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already disabled and removed Ragic Cloud DB from the QNAP App Center, pending a security patch from Ragic.
Se ha informado de una vulnerabilidad de tipo cross-site scripting (XSS) reflejado que afecta al NAS de QNAP que ejecuta Ragic Cloud DB. Si es explotado, esta vulnerabilidad permite a atacantes remotos inyectar código malicioso. QNAP ya ha deshabilitado y eliminado Ragic Cloud DB del QNAP App Center, pendiente de un parche de seguridad de Ragic
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-08-13 CVE Reserved
- 2021-11-20 CVE Published
- 2024-08-03 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.qnap.com/en/security-advisory/qsa-21-48 | 2021-11-23 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Qnap Search vendor "Qnap" | Ragic Cloud Db Search vendor "Qnap" for product "Ragic Cloud Db" | <= 3.7.0.1 Search vendor "Qnap" for product "Ragic Cloud Db" and version " <= 3.7.0.1" | - |
Affected
| in | Qnap Search vendor "Qnap" | Nas Search vendor "Qnap" for product "Nas" | - | - |
Safe
|