1. Home
  2. CVE Database
  3. CVE-2023-39296
HIGH · 7.5

CVE-2023-39296

A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that...

Vulnerability Description

A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
QnapQts5.1.0.2348
QnapQuts Heroh5.1.0.2409

Related Weaknesses (CWE)

CWE-1321

References

FAQ

What is CVE-2023-39296?

CVE-2023-39296 is a vulnerability with a CVSS score of 7.5 (HIGH). A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that...

How severe is CVE-2023-39296?

CVE-2023-39296 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-39296?

Check the references section above for vendor advisories and patch information. Affected products include: Qnap Qts, Qnap Quts Hero.