High severity · published Dec 24, 2020
CVE-2020-2504
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station
7.5
CVSS
1%
EPSS
No
On KEV
Description
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QE
Qes · Qnap
before 2.1.1; 2.1.1; 2.1.1; 2.1.1; 2.1.1; 2.1.1; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-2504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-2504
Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-20-17
More from Qes
7.2
CVE-2020-2499
A hard-coded password vulnerability has been reported to affect earlier versions of QES
5.4
CVE-2020-2503
If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station
2.3
CVE-2020-2505
If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages