CVE-2024-27123

A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later

CVSS

No CVSS.

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-24-54

Configurations

No configuration.

History

28 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de cross-site scripting (XSS) ha sido reportada que afecta a QcalAgent. Los atacantes locales pueden entonces explotar la vulnerabilidad para eludir mecanismos de seguridad o leer datos de la aplicación. Hemos corregido la vulnerabilidad en la siguiente versión: QcalAgent 1.1.9 y posteriores

18 Sep 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-18 07:16

Updated : 2026-09-28 14:10

NVD link : CVE-2024-27123

Mitre link : CVE-2024-27123

CVE.ORG link : CVE-2024-27123

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-27123", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27123", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T14:15:17.149405Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@qnapsecurity.com.tw", "affectedData": [{"vendor": "QNAP Systems Inc.", "product": "QcalAgent", "versions": [{"status": "affected", "version": "1.1.0", "lessThan": "1.1.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-18T07:16:48.117", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-54", "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data.\n\nWe have already fixed the vulnerability in the following version:\nQcalAgent 1.1.9 and later"}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) ha sido reportada que afecta a QcalAgent. Los atacantes locales pueden entonces explotar la vulnerabilidad para eludir mecanismos de seguridad o leer datos de la aplicaci\u00f3n.\n\nHemos corregido la vulnerabilidad en la siguiente versi\u00f3n:\nQcalAgent 1.1.9 y posteriores"}], "lastModified": "2026-09-28T14:10:00.213", "sourceIdentifier": "security@qnapsecurity.com.tw"}