VulnerabilityModified
CVE-2018-19946
The vulnerability have been reported to affect earlier versions of Helpdesk.
MEDIUM 5.9EPSS 0.32%
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.32% probability · 24th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295, CWE-297
- Affected
- qnap/helpdesk
- Source
- security@qnapsecurity.com.tw
References
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-05Vendor Advisory
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-05Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.