VDB
CVE-2024-38646
CVE-2024-38646
PUBLISHED
CVSS 8.399999618530273 HIGH
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow local authenticated attackers who have gained administrator access to read or modify the resource. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
EPSS 0.18% · 6.6th percentile
Risk Scores
CVSS 4.0
8.399999618530273
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H
EPSS Score
0.18%
6.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | Notes Station 3 | 3.9.x |
| qnap | notes_station_3 | 3.9.0 |
| qnap | notes_station_3 | 3.9.0 |
Timeline
- Nov 22, 2024 CVE Published
- Nov 23, 2024 EPSS Score
- Nov 26, 2024 PoC Published
- Dec 2, 2024 Coalition ESS Score
- Dec 12, 2024 EPSS Score
- Dec 29, 2024 EPSS Score
- Jan 16, 2025 EPSS Score
- Feb 2, 2025 EPSS Score
- Feb 20, 2025 EPSS Score
- Mar 9, 2025 EPSS Score
- Mar 27, 2025 EPSS Score
- Apr 13, 2025 EPSS Score
References
- https://www.qnap.com/go/security-advisory/qsa-24-47 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-36 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-43 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-44 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-46 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-39 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-40 advisory
- https://www.qnap.com/en/security-advisory/qsa-24-36 url
- https://nvd.nist.gov/vuln/detail/CVE-2024-38646 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-37 advisory