VDB
CVE-2024-38645
CVE-2024-38645
PUBLISHED
CVSS 9.399999618530273 CRITICAL
A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to read application data. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
EPSS 0.63% · 46.9th percentile
Risk Scores
CVSS 4.0
9.399999618530273
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS Score
0.63%
46.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| qnap | notes_station_3 | 3.9.0 |
| qnap | notes_station_3 | 3.9.0 |
| QNAP Systems Inc. | Notes Station 3 | 3.9.x |
Timeline
- Nov 22, 2024 CVE Published
- Nov 22, 2024 CVE Updated
- Nov 23, 2024 EPSS Score
- Nov 26, 2024 PoC Published
- Nov 26, 2024 PoC Published
- Dec 11, 2024 EPSS Score
- Dec 29, 2024 EPSS Score
- Jan 15, 2025 EPSS Score
- Feb 1, 2025 EPSS Score
- Feb 10, 2025 Coalition ESS Score
- Feb 19, 2025 EPSS Score
- Mar 8, 2025 EPSS Score
References
- https://www.qnap.com/go/security-advisory/qsa-24-44 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-36 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-37 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-39 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-47 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-40 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-46 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-43 advisory
- https://www.qnap.com/en/security-advisory/qsa-24-36 url
- https://nvd.nist.gov/vuln/detail/CVE-2024-38645 advisory