Path Traversal in QNAP Qts

CVE-2013-7174

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.021 (79.4th percentile) — read the EPSS interpretation.

Affected products

Qnap Qts — versions 4.0
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
cret@cert.org (vdb-entry, x_refsource_BID)
cret@cert.org (vdb-entry, x_refsource_SECTRACK)