Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-2493: This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later.

CVE-2020-2493 · published 5 years ago

Summary

This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later.

What to do

Update qnap multimedia_console to version 1.1.5 or later.

Affected software

Vendor	Product	Affected versions
qnap	multimedia_console	< 1.1.5 `cpe:2.3:a:qnap:multimedia_console::::::::`

Original advisory text

This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later.

References

https://www.qnap.com/en/security-advisory/qsa-20-14 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

CWE-80Basic XSS

Timeline

Published10 Dec 2020

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2020-2493 · NVD

Track software like this

Free during beta