CVE-2023-32967

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. QTS 5.x, QuTS hero are not affected.

We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 4.5.4.2627 build 20231225 and later

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	QuTScloud	>= c5.x.x, < c5.1.5.2651
QNAP Systems Inc.	QTS	>= 4.5.x, < 4.5.4.2627 build 20231225
QNAP Systems Inc.	QuTS hero	—

References

https://www.qnap.com/en/security-advisory/qsa-24-01Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-24-01Vendor Advisory

Timeline

Published: Feb 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-329687.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329694.8A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow CVE-2023-32977.8In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus CVE-2023-329704.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2023-329717.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329727.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329737.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329747.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could all CVE-2023-329757.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329767.2An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticat CVE-2023-329775.4Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored CVE-2023-329784.3A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server us