PT-2018-2682 · Synology · Synology Photo Station

Publicado 2018-07-23 · Atualizado 2019-10-09 · CVE-2018-13282

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.8.7-3481

Description The issue is related to a session fixation problem in the SYNO.PhotoStation.Auth component. It allows remote attackers to hijack web sessions via the PHPSESSID parameter, potentially leading to unauthorized access to protected data.

Recommendations For versions prior to 6.8.7-3481, update to version 6.8.7-3481 or later to resolve the issue. As a temporary workaround, consider restricting access to the PHPSESSID parameter to minimize the risk of session hijacking.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

BDU:2019-01342

CVE-2018-13282

Produtos afetados

Synology Photo Station

Referências · 4

• https://synology.com/en-global/support/security/Synology_SA_18_37 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13282 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13282 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01342 · Nota de Segurança