CVE-2024-48866
MEDIUMDescription
An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2024-48866? +
How severe is CVE-2024-48866? +
What products are affected by CVE-2024-48866? +
How do I check if I'm vulnerable to CVE-2024-48866? +
Related Vulnerabilities
Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal …
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that …
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could …
A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow …
A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to …