CVE-2020-2505

Sensitive information via generation of error messages vulnerability in QES

CVSS 2.3 LOWEPSS 0.3%CWE-209 CWE-755

Vexday Risk Score

8Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 2.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

24 Dec 2020Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Affected products

QNAP Systems Inc. · QES

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-17