CVE-2020-2500
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-2500
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
访问控制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
QNAP Systems Helpdesk 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
QNAP Systems Helpdesk是中国威联通（QNAP Systems）公司的一款帮助台应用程序。 QNAP Systems Helpdesk 3.0.1之前版本中存在安全漏洞。攻击者可借助API??密钥利用该漏洞访问QNAP Kayako服务器上的敏感数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| QNAP Systems Inc. | Helpdesk | unspecified ~ 3.0.1 | - |
II. Public POCs for CVE-2020-2500
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-2500
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Helpdesk
- CVE-2026-23753
GFI HelpDesk < 4.99.9 Stored XSS via charset Parameter - CVE-2026-23752
GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter - CVE-2026-23756
GFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Sub - CVE-2026-23758
GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter - CVE-2026-23757
GFI HelpDesk < 4.99.10 Stored XSS via Reports Module
Same weakness: CWE-284
- CVE-2026-8233
Dotouch XproUPF access control - CVE-2026-42569
phpvms: /importer authorization bypass causing full database - CVE-2026-42205
Avo: Broken Access Control: Unauthorized Execution of Arbitr - CVE-2026-41487
Langfuse: Improper role-based-access control in Langfuse LLM - CVE-2026-42278
UltraDAG: Smart Account Spending Policy Bypass via Pockets
V. Comments for CVE-2020-2500
No comments yet