CVE-2018-19948

low-risk
Published 2020-09-11

The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow attackers to force NAS users to execute unintentional actions through a web application. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.

Do I need to act?

-
0.12% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.0/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Helpdesk

Affected Vendors

Qnap

References (2)

Vendor Advisory https://www.qnap.com/zh-tw/security-advisory/qsa-20-05
Vendor Advisory https://www.qnap.com/zh-tw/security-advisory/qsa-20-05
14
/ 100
low-risk
Severity 8/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal