Medium severity · published Dec 5, 2019
CVE-2019-7185
This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console
4.8
CVSS
1.5%
EPSS
No
On KEV
Description
This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Music Station to their latest versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Music Station · Qnap
before 5.3.5; before 5.2.7; before 5.1.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7185
Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/nas-201911-27
More from Music Station
9.8
CVE-2018-19950
If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands
9.8
CVE-2018-0729
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device
9.8
CVE-2018-0718
Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised…
9.8
CVE-2017-13069
QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier
8.8
CVE-2023-45038
Music Station