PT-2019-8964 · Synology · Synology Calendar

Chun Han Hsiao · Publicado 2019-04-01 · Atualizado 2019-10-09 · CVE-2018-13299

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Synology Calendar versions prior to 2.2.2-0532

Description A relative path traversal issue exists in the Attachment Uploader of Synology Calendar, allowing remote authenticated users to upload arbitrary files by manipulating the filename parameter.

Recommendations For versions prior to 2.2.2-0532, update to version 2.2.2-0532 or later to resolve the issue.

Correção

Relative Path Traversal

Path traversal

Enumeração de Fraquezas

CWE-23

CWE-22

Identificadores relacionados

CVE-2018-13299

Produtos afetados

Synology Calendar

Referências · 3

• https://synology.com/security/advisory/Synology_SA_18_54 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13299 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13299 · Aviso do Fabricante