Low severity · published Dec 24, 2020
CVE-2020-2505
If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages
2.3
CVSS
0.3%
EPSS
No
On KEV
Description
If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QE
Qes · Qnap
before 2.1.1; 2.1.1; 2.1.1; 2.1.1; 2.1.1; 2.1.1; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-2505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-2505
Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-20-17
More from Qes
7.5
CVE-2020-2504
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station
7.2
CVE-2020-2499
A hard-coded password vulnerability has been reported to affect earlier versions of QES
5.4
CVE-2020-2503
If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station