PT-2019-8948 · Synology · Synology Ssl Vpn Client

Yu-Chi Ding · Publicado 2019-04-01 · Atualizado 2019-10-09 · CVE-2018-13283

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology SSL VPN Client versions prior to 1.2.5-0226

Description The issue is related to a lack of administrator control over security vulnerabilities in the client.cgi component. This allows remote attackers to conduct man-in-the-middle attacks by manipulating the command, hostname, or port parameters.

Recommendations For versions prior to 1.2.5-0226, update to version 1.2.5-0226 or later to resolve the issue. As a temporary workaround, consider restricting access to the client.cgi component to minimize the risk of exploitation. Avoid using the command, hostname, or port parameters in the affected API endpoint until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-671

Identificadores relacionados

CVE-2018-13283

Produtos afetados

Synology Ssl Vpn Client

Referências · 3

• https://synology.com/security/advisory/Synology_SA_18_30 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13283 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13283 · Aviso do Fabricante