PT-2017-11786 · Synology · Synology Photo Station

Publicado 2017-09-08 · Atualizado 2019-10-09 · CVE-2017-11161

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.7.4-3433 Synology Photo Station versions prior to 6.3-2968

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the article id parameter to "label.php" or the type parameter to "synotheme.php".

Recommendations For versions prior to 6.7.4-3433, update to version 6.7.4-3433 or later. For versions prior to 6.3-2968, update to version 6.3-2968 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-11161

Produtos afetados

Synology Photo Station

Referências · 3

• https://synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11161 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11161 · Aviso do Fabricante