CVE-2021-28809: QNAP Systems Inc. HBS 3, заобикаляне на вход и права

Описание

Оригинално описание

An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to compromise the security of the operating system.QNAP have already fixed this vulnerability in the following versions of HBS 3: QTS 4.3.6: HBS 3 v3.0.210507 and later QTS 4.3.4: HBS 3 v3.0.210506 and later QTS 4.3.3: HBS 3 v3.0.210506 and later

Засегнати продукти

• QNAP Systems Inc. HBS 3: unspecified преди v3.0.210507
• QNAP Systems Inc. HBS 3: unspecified преди v3.0.210506
• QNAP Systems Inc. HBS 3: unspecified преди v3.0.210506

Вид слабост

• CWE-284 Неправилен контрол на достъпа
• CWE-306 Липсваща автентикация за критична функционалност
• CWE-749 Exposed Dangerous Method or Function

История

Други уязвимости в QNAP Systems Inc. HBS 3

• 10.0CVE-2021-28799

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-28809
• https://nvd.nist.gov/vuln/detail/CVE-2021-28809
• https://www.qnap.com/en/security-advisory/qsa-21-19
• https://www.zerodayinitiative.com/advisories/ZDI-21-783/