CVE-2023-32967
02.02.2024, 16:15
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. QTS 5.x, QuTS hero are not affected. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 4.5.4.2627 build 20231225 and laterEnginsight
| Vendor | Product | Version |
|---|---|---|
| qnap | qts | 4.5.4.1715:build_20210630 |
| qnap | qts | 4.5.4.1723:build_20210708 |
| qnap | qts | 4.5.4.1741:build_20210726 |
| qnap | qts | 4.5.4.1787:build_20210910 |
| qnap | qts | 4.5.4.1800:build_20210923 |
| qnap | qts | 4.5.4.1892:build_20211223 |
| qnap | qts | 4.5.4.1931:build_20220128 |
| qnap | qts | 4.5.4.2012:build_20220419 |
| qnap | qts | 4.5.4.2117:build_20220802 |
| qnap | qts | 4.5.4.2280:build_20230112 |
| qnap | qts | 4.5.4.2374:build_20230416 |
| qnap | qts | 4.5.4.2627 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-285 - Improper AuthorizationThe software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.