Improper Access Control in Helpdesk

Summary

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.

Recommendation

To fix the vulnerability, we strongly recommend updating Helpdesk to the latest version.

Updating Helpdesk

1. Log on to QTS as administrator.
2. Open the App Center, and then click .
   A search box appears.
3. Type “Helpdesk”, and then press ENTER.

   The Helpdesk application appears in the search result list.

4. Click Update.

   A confirmation message appears.

   Note: The Update button is not available if you are using the latest version.

5. Click OK.

   The application is updated.