How severe is CVE-2018-19953?

CVE-2018-19953 has a CVSS 3.1 base score of 6.1 (MEDIUM). EPSS estimates a 28.8% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2018-19953: QNAP NAS File Station Cross-Site Scripting

CISA Known Exploited Vulnerabilities

QNAP NAS File Station Cross-Site Scripting Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-05-24

Remediation due

2022-06-14

Ransomware

Known use

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2018-19953

Description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Severity

CVSS 3.1 · CISA6.1 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
QNAP Systems Inc.	QTS	unspecified to <4.4.2.1231
QNAP Systems Inc.	QTS	unspecified to <4.4.1.1201
QNAP Systems Inc.	QTS	unspecified to <4.3.6.1218
QNAP Systems Inc.	QTS	unspecified to <4.3.4.1190
QNAP Systems Inc.	QTS	unspecified to <4.3.3.1161 unspecified to <4.2.6

References

1 Links

Other references

https://www.qnap.com/zh-tw/security-advisory/qsa-20-01

Record Details

Published

2020-10-28

Last updated

2026-10-01

Assigner (CNA)

qnap

Credited to

Independent Security Evaluators

More from QNAP Systems Inc.

CVE-2022-2759310

DeadBolt Ransomware

CVE-2021-2879910

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

CVE-2023-475658

Legacy VioStor NVR

CVE-2020-25099.8

Command Injection Vulnerability in QTS and QuTS hero

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-79 · Cross-site Scripting

Application Security Tools Penetration Testing Tools

CWE-80 · Script-related HTML Tag Injection

Application Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.