CVE-2020-2503

Name of the Vulnerable Software and Affected Versions QNAP QES versions prior to 2.1.1 Build 20201006

Description This issue is related to a stored cross-site scripting vulnerability that could allow remote attackers to inject malicious code in File Station. The vulnerability is associated with the lack of protection measures for the web page structure, which could enable a remote attacker to perform a cross-site scripting attack.

Recommendations For QNAP QES versions prior to 2.1.1 Build 20201006, update to QES 2.1.1 Build 20201006 or later to resolve the issue. As a temporary workaround, consider restricting access to the File Station to minimize the risk of exploitation.