CVE-2024-53696

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

A

server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.7.0.829 ( 2024/10/01 ) and later QuLog Center 1.8.0.888 ( 2024/10/15 ) and later QTS 4.5.4.2957 build 20241119 and later QuTS hero h4.5.4.2956 build 20241119 and later

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-24-53	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:qnap:qulog_center::::::::
	cpe:2.3:a:qnap:qulog_center::::::::
	cpe:2.3:o:qnap:qts::-::::::*
	cpe:2.3:o:qnap:quts_hero::-::::::*

History

06 Dec 2025, 00:34

Type	Values Removed	Values Added
CPE		cpe:2.3:a:qnap:qulog_center:::::::: cpe:2.3:o:qnap:quts_hero::-::::::* cpe:2.3:o:qnap:qts::-::::::*
References	~~() https://www.qnap.com/en/security-advisory/qsa-24-53 -~~	() https://www.qnap.com/en/security-advisory/qsa-24-53 - Vendor Advisory
First Time		Qnap qulog Center Qnap quts Hero Qnap Qnap qts
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.9

07 Mar 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-07 17:15

Updated : 2025-12-06 00:34

NVD link : CVE-2024-53696

Mitre link : CVE-2024-53696

CVE.ORG link : CVE-2024-53696

JSON object : View

Products Affected

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-53696", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-07T17:15:20.390", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-53", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data.\n\nWe have already fixed the vulnerability in the following versions:\nQuLog Center 1.7.0.829 ( 2024/10/01 ) and later\nQuLog Center 1.8.0.888 ( 2024/10/15 ) and later\nQTS 4.5.4.2957 build 20241119 and later\nQuTS hero h4.5.4.2956 build 20241119 and later"}, {"lang": "es", "value": "Se ha informado de una vulnerabilidad de server-side request forgery (SSRF) que afecta a QuLog Center. Si se explota, la vulnerabilidad podr\u00eda permitir a atacantes remotos que hayan obtenido acceso de administrador leer datos de la aplicaci\u00f3n. Ya hemos corregido la vulnerabilidad en las siguientes versiones: QuLog Center 1.7.0.829 (2024/10/01) y posteriores QuLog Center 1.8.0.888 (2024/10/15) y posteriores QTS 4.5.4.2957 compilaci\u00f3n 20241119 y posteriores QuTS hero h4.5.4.2956 compilaci\u00f3n 20241119 y posteriores"}], "lastModified": "2025-12-06T00:34:08.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qnap:qulog_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EE4AC97-FB07-4CC0-ADD8-E52DB261572F", "versionEndExcluding": "1.7.0.829", "versionStartIncluding": "1.7.0"}, {"criteria": "cpe:2.3:a:qnap:qulog_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADD853AD-F4FD-44E5-8856-8618807A4769", "versionEndExcluding": "1.8.0.888", "versionStartIncluding": "1.8.0"}, {"criteria": "cpe:2.3:o:qnap:qts:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8AC9ED9-D346-46F1-B97F-E8CC259F3DA9", "versionEndExcluding": "4.5.4.2957", "versionStartIncluding": "4.5.1"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E191F9BB-C20F-4A86-A7B4-8BB55FBB7B53", "versionEndExcluding": "h4.5.4.2476", "versionStartIncluding": "h4.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}