What is CVE-2020-2504?

CVE-2020-2504 is a medium-severity vulnerability in Qnap Qes, classified under Improper Input Validation. CVSS score: 5.8/10. Published 2020-12-24.

How severe is CVE-2020-2504?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Path Traversal in Qnap Qes

CVE-2020-2504

If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.010 (59.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

Affected products

Qnap Qes — versions 2.1.1
Qnap Systems Inc. Qes — versions unspecified

Weakness classification (CWE)

CWE-20 — Improper Input Validation
CWE-22 — Path Traversal
CWE-73 — External Control of File Name or Path
CWE-284 — Improper Access Control

References

security@qnapsecurity.com.tw (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-2504?: CVE-2020-2504 is a medium-severity vulnerability in Qnap Qes, classified under Improper Input Validation. CVSS score: 5.8/10. Published 2020-12-24.
How severe is CVE-2020-2504?: Medium severity. CVSS v3 base score is 5.8 out of 10.