{"id":"CVE-2023-47221","published":"2024-03-08T16:15:23Z","modified":"2024-08-02T21:01:22Z","title":"Photo Station","vendor":"QNAP","product":"Photo Station","tier":"tail","description":{"text":"A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.\n\nWe have already fixed the vulnerability in the following version:\nPhoto Station 6.4.2 ( 2023/12/15 ) and later\n","provenance":"source","from":"CVE.org"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0045,"percentile":0.38984,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-24-13","tags":[]}],"priority":{"score":11.6,"factors":[{"name":"EPSS percentile","points":7.8},{"name":"CVSS severity","points":3.85}]},"vendorSlug":"qnap","affectedVersions":[{"vendor":"QNAP Systems Inc.","product":"Photo Station","versions":[">= 6.4.x, < 6.4.2 ( 2023/12/15 )"]}],"euvd":{"id":"EUVD-2023-51353","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-qnap-photo-station-cwe-22"}}