SoftNAS Cloud 4.2.0

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:softnas:cloud:4.2.0:*:*:*:*:*:*:*

part: a version: 4.2.0 update: *

VendorSoftnas (51c3e31e-4485-5a54-8c4e-081d7a939f46)
ProductCloud (9b29e05d-5a6f-5a90-bf89-9b12dc8857be)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2019-9945 vulnerable 2026-06-08 05:14:26.632167 Details available
SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web interface without valid user credentials. If customers have not followed SoftNAS deployment best practices and expose SoftNAS StorageCenter ports directly to the internet, this vulnerability allows an attacker to gain access to the Webadmin interface to create new users or execute arbitrary commands with administrative privileges, compromising both the platform and the data.
Published: 2019-03-23T15:03:06.000Z
Updated: 2024-08-04T22:10:08.408Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.