PT-2017-14549 · Synology · Synology Mailplus Server

Publicado 2017-12-27 · Atualizado 2018-01-10 · CVE-2017-16768

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synology MailPlus Server versions prior to 1.4.0-0415

Description A cross-site scripting (XSS) issue exists in the User Policy editor, allowing remote authenticated users to inject arbitrary HTML via the name parameter. This could potentially lead to unauthorized actions on the affected system.

Recommendations For versions prior to 1.4.0-0415, update to version 1.4.0-0415 or later to resolve the issue. As a temporary workaround, consider restricting access to the User Policy editor to minimize the risk of exploitation. Avoid using the name parameter in the affected editor until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-16768

Produtos afetados

Synology Mailplus Server

Referências · 3

• https://synology.com/en-global/support/security/Synology_SA_17_81 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16768 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16768 · Aviso do Fabricante