dbcve.org
Qulog CenterApplication · Qnap

CVE-2023-23354

HIGH · 8.7 CVSS v3.1 Published 2024-12-19
Fix available
A fix is available. Upgrade to 1.3.1.645 / 1.4.1.691 or later.
See remediation →
91/100
Remediation priority · Urgent
Remotely reachable

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.5.0.738 ( 2023/03/06 ) and later QuLog Center 1.4.1.691 ( 2023/03/01 ) and later QuLog Center 1.3.1.645 ( 2023/02/22 ) and later

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A cross-site scripting (XSS) vulnerability in QNAP QuLog Center allows authenticated remote attackers to bypass security mechanisms or read application data. The vulnerability affects multiple QuLog Center versions prior to the patched releases.

MitigationUpdate QuLog Center to version 1.5.0.738 (2023/03/06), 1.4.1.691 (2023/03/01), or 1.3.1.645 (2023/02/22) or later to remediate this vulnerability.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Qulog CenterApplication
Affected:< 1.5.0.738< 1.3.1.645< 1.4.1.691

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify QuLog Center is installed
    Check for the presence of QuLog Center application on the QNAP NAS system. This may be visible in the QTS App Center or via command line enumeration of installed packages.
    Affected if QuLog Center is installed and running on the system
  2. Identify the installed QuLog Center version
    Locate the version information for QuLog Center. This is typically found in the QTS App Center interface by clicking on QuLog Center, or via command line tools such as 'qpkg -i' or reviewing application metadata in /share/CACHEDEV1_DATA/.qpkg/QuLogCenter or similar paths.
    Affected if Unable to determine the version, or version information shows the application is present
  3. Compare installed version against affected ranges
    Take the identified version number and compare it against the three vulnerable ranges: versions prior to 1.5.0.738, versions prior to 1.3.1.645, and versions prior to 1.4.1.691. Determine if the installed version falls into any of these ranges.
    Affected if Installed version is less than 1.5.0.738 OR less than 1.3.1.645 OR less than 1.4.1.691 (the specific vulnerable range depends on which release branch is in use)
  4. Confirm remote access to QuLog Center is enabled
    Verify that QuLog Center is accessible over the network. Check if the web interface port (typically 8080 or configured custom port) is open and reachable from network clients.
    Affected if QuLog Center web interface is exposed to the network
  5. Verify authentication is configured for QuLog Center
    Confirm that user accounts are configured and authentication is required to access QuLog Center. The vulnerability states it affects 'authenticated' attackers, meaning the XSS can be triggered by users who can log in.
    Affected if QuLog Center has user authentication enabled (this confirms the attack vector is relevant)

The environment is affected if QuLog Center is installed with a version less than 1.5.0.738, 1.3.1.645, or 1.4.1.691 (depending on the release branch) and is accessible with authentication enabled.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 1.3.1.645 / 1.4.1.691 / 1.5.0.738 or later
Fixed in 1.3.1.6451.4.1.6911.5.0.738
Interim mitigation

Update QuLog Center to version 1.5.0.738 (2023/03/06), 1.4.1.691 (2023/03/01), or 1.3.1.645 (2023/02/22) or later to remediate this vulnerability.

Recommended fix High confidence

QuLog Center 1.5.0.738 (or the latest available version in your branch: 1.3.1.645+/1.4.1.691+/1.5.0.738+)

  1. 1. Identify the current version of QuLog Center running on the QNAP device
  2. 2. Download the appropriate fixed version from the official QNAP website (www.qnap.com)
  3. 3. Access QNAP Admin Console and navigate to QuLog Center application
  4. 4. Install the update following QNAP's standard update procedure
  5. 5. Verify the new version is installed correctly

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Qulog Center Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
7.0 hours of engineering $1,240
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-23354 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-23354 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data