CVE-2024-53696

A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.7.0.829 ( 2024/10/01 ) and later QuLog Center 1.8.0.888 ( 2024/10/15 ) and later QTS 4.5.4.2957 build 20241119 and later QuTS hero h4.5.4.2956 build 20241119 and later

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-24-53	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:qnap:qulog_center::::::::
	cpe:2.3:a:qnap:qulog_center::::::::
	cpe:2.3:o:qnap:qts::-::::::*
	cpe:2.3:o:qnap:quts_hero::-::::::*

History

06 Dec 2025, 00:34

Type	Values Removed	Values Added
References	~~() https://www.qnap.com/en/security-advisory/qsa-24-53 -~~	() https://www.qnap.com/en/security-advisory/qsa-24-53 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.9
CPE		cpe:2.3:o:qnap:quts_hero::-::::::* cpe:2.3:o:qnap:qts::-::::::* cpe:2.3:a:qnap:qulog_center::::::::
First Time		Qnap qulog Center Qnap qts Qnap quts Hero Qnap
Summary		(es) Se ha informado de una vulnerabilidad de server-side request forgery (SSRF) que afecta a QuLog Center. Si se explota, la vulnerabilidad podría permitir a atacantes remotos que hayan obtenido acceso de administrador leer datos de la aplicación. Ya hemos corregido la vulnerabilidad en las siguientes versiones: QuLog Center 1.7.0.829 (2024/10/01) y posteriores QuLog Center 1.8.0.888 (2024/10/15) y posteriores QTS 4.5.4.2957 compilación 20241119 y posteriores QuTS hero h4.5.4.2956 compilación 20241119 y posteriores

07 Mar 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-07 17:15

Updated : 2025-12-06 00:34

NVD link : CVE-2024-53696

Mitre link : CVE-2024-53696

CVE.ORG link : CVE-2024-53696

JSON object : View

Products Affected

qnap

qulog_center
qts
quts_hero

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-53696", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-07T17:15:20.390", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-53", "tags": ["Vendor Advisory"], "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data.\n\nWe have already fixed the vulnerability in the following versions:\nQuLog Center 1.7.0.829 ( 2024/10/01 ) and later\nQuLog Center 1.8.0.888 ( 2024/10/15 ) and later\nQTS 4.5.4.2957 build 20241119 and later\nQuTS hero h4.5.4.2956 build 20241119 and later"}, {"lang": "es", "value": "Se ha informado de una vulnerabilidad de server-side request forgery (SSRF) que afecta a QuLog Center. Si se explota, la vulnerabilidad podr\u00eda permitir a atacantes remotos que hayan obtenido acceso de administrador leer datos de la aplicaci\u00f3n. Ya hemos corregido la vulnerabilidad en las siguientes versiones: QuLog Center 1.7.0.829 (2024/10/01) y posteriores QuLog Center 1.8.0.888 (2024/10/15) y posteriores QTS 4.5.4.2957 compilaci\u00f3n 20241119 y posteriores QuTS hero h4.5.4.2956 compilaci\u00f3n 20241119 y posteriores"}], "lastModified": "2025-12-06T00:34:08.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qnap:qulog_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EE4AC97-FB07-4CC0-ADD8-E52DB261572F", "versionEndExcluding": "1.7.0.829", "versionStartIncluding": "1.7.0"}, {"criteria": "cpe:2.3:a:qnap:qulog_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADD853AD-F4FD-44E5-8856-8618807A4769", "versionEndExcluding": "1.8.0.888", "versionStartIncluding": "1.8.0"}, {"criteria": "cpe:2.3:o:qnap:qts:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8AC9ED9-D346-46F1-B97F-E8CC259F3DA9", "versionEndExcluding": "4.5.4.2957", "versionStartIncluding": "4.5.1"}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E191F9BB-C20F-4A86-A7B4-8BB55FBB7B53", "versionEndExcluding": "h4.5.4.2476", "versionStartIncluding": "h4.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}