CVE-2023-39296

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Jan 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-392978.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2023-392987.8A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2023-392997.5A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the cont CVE-2023-393007.2An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated admi CVE-2023-393014.3A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vul CVE-2023-393027.2An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2023-393039.8An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2023-393055.3Missing Authorization vulnerability in Dash Labs Yet Another Stars Rating yet-another-stars-rating allows Exploiting Incorrectly Configured CVE-2023-393067.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows Refl CVE-2023-393078.8Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.CVE-2023-393086.1Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.7 versions.CVE-2023-393098.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue