PT-2018-18716 · Synology · Synology Router Manager

Publicado 2018-12-24 · Atualizado 2019-10-09 · CVE-2018-8918

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Synology Router Manager (SRM) versions prior to 1.1.7-6941

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the host parameter in the info.cgi file.

Recommendations For versions prior to 1.1.7-6941, update to version 1.1.7-6941 or later to resolve the issue. As a temporary workaround, consider restricting access to the info.cgi file to minimize the risk of exploitation. Avoid using the host parameter in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-8918

Produtos afetados

Synology Router Manager

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-8918 · Aviso do Fabricante
• https://synology.com/security/advisory/Synology_SA_18_25 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8918 · Nota de Segurança