{"api_version":"1","generated_at":"2026-04-23T16:55:46+00:00","cve":"CVE-2021-38675","urls":{"html":"https://cve.report/CVE-2021-38675","api":"https://cve.report/api/cve/CVE-2021-38675.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-38675","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-38675"},"summary":{"title":"CVE-2021-38675","description":"A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later","state":"PUBLIC","assigner":"security@qnap.com","published_at":"2021-10-01 03:15:00","updated_at":"2021-10-04 15:53:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-21-43","name":"https://www.qnap.com/en/security-advisory/qsa-21-43","refsource":"MISC","tags":[],"title":"Stored XSS Vulnerability in Image2PDF - Security Advisory | QNAP","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38675","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38675","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Tony Martin, a security researcher","lang":""}],"nvd_cpes":[{"cve_year":"2021","cve_id":"38675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"qnap","cpe5":"image2pdf","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"38675","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"qnap","cpe5":"nas","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@qnap.com","DATE_PUBLIC":"2021-10-01T10:26:00.000Z","ID":"CVE-2021-38675","STATE":"PUBLIC","TITLE":"Stored XSS Vulnerability in Image2PDF"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Image2PDF","version":{"version_data":[{"version_affected":"<","version_value":"2.1.5 ( 2021/08/17 )"}]}}]},"vendor_name":"QNAP Systems Inc."}]}},"credit":[{"lang":"eng","value":"Tony Martin, a security researcher"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later"}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://www.qnap.com/en/security-advisory/qsa-21-43","name":"https://www.qnap.com/en/security-advisory/qsa-21-43"}]},"solution":[{"lang":"eng","value":"We have already fixed this vulnerability in the following versions of Image2PDF:\nImage2PDF 2.1.5 ( 2021/08/17 ) and later\n"}],"source":{"advisory":"QSA-21-43","discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2021-10-01 03:15:00","lastModifiedDate":"2021-10-04 15:53:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.3,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:qnap:image2pdf:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.5","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:h:qnap:nas:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"38675","Ordinal":"214346","Title":"CVE-2021-38675","CVE":"CVE-2021-38675","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"38675","Ordinal":"1","NoteData":"A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later","Type":"Description","Title":null},{"CveYear":"2021","CveId":"38675","Ordinal":"2","NoteData":"2021-09-30","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"38675","Ordinal":"3","NoteData":"2021-09-30","Type":"Other","Title":"Modified"}]}}}