PT-2017-14548 · Synology · Synology Diskstation Manager

CVE-2017-16766 · Publicado 2017-12-22 · Atualizado 2025-01-14

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions prior to 6.1.4-15217 Synology DiskStation Manager (DSM) versions prior to 6.0.3-8754-6

Description An improper access control issue in synodsmnotify allows local users to inject arbitrary web script or HTML via the -fn option. This could potentially lead to unauthorized access or execution of malicious code.

Recommendations For versions prior to 6.1.4-15217, update to version 6.1.4-15217 or later. For versions prior to 6.0.3-8754-6, update to version 6.0.3-8754-6 or later. As a temporary workaround, consider restricting access to the synodsmnotify utility until a patch is applied.

Correção

Special Elements Injection

Improper Access Control

Enumeração de Fraquezas

CWE-74

CWE-284

Identificadores relacionados

CVE-2017-16766

Produtos afetados

Synology Diskstation Manager

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-16766 · Nota de Segurança
• https://synology.com/en-global/support/security/Synology_SA_17_74 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16766 · Aviso do Fabricante
• https://t.me/cvenotify/107341 · Publicação no Telegram