CVE-2018-19945

A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.

A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.

Se ha reportado de una vulnerabilidad que afecta a los dispositivos QNAP anteriores que ejecutan QTS versión 4.3.4 a la 4.3.6. Causada por limitaciones inapropiadas de un nombre de ruta en un directorio restringido, esta vulnerabilidad permite cambiar el nombre de archivos arbitrarios en el sistema de destino, si se explota. QNAP ya ha corregido esta vulnerabilidad en las siguientes versiones: QTS versión 4.3.6.0895 build 20190328 (y posterior) QTS versión 4.3.4.0899 build 20190322 (y posterior) Este problema no afecta a QTS versión 4.4.x o QTS versión 4.5.x.