PT-2017-11775 · Synology · Synology Office

Publicado 2017-08-14 · Atualizado 2019-10-03 · CVE-2017-11150

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Office versions 2.2.0-1502 through 2.2.1-1506

Description A command injection issue exists, allowing remote authenticated users to execute arbitrary commands. This is achieved by using shell metacharacters in the crafted file name of RTF documents.

Recommendations For versions 2.2.0-1502 through 2.2.1-1506, update to a version that contains a fix for this issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-11150

Produtos afetados

Synology Office

Referências · 3

• https://synology.com/en-global/support/security/Synology_SA_17_26_Office · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-11150 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11150 · Nota de Segurança