PT-2017-11775 · Synology · Synology Office

Published 2017-08-14 · Updated 2019-10-03 · CVE-2017-11150

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Office versions 2.2.0-1502 through 2.2.1-1506

Description A command injection issue exists, allowing remote authenticated users to execute arbitrary commands. This is achieved by using shell metacharacters in the crafted file name of RTF documents.

Recommendations For versions 2.2.0-1502 through 2.2.1-1506, update to a version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-11150

Affected Products

Synology Office

References · 3

• https://synology.com/en-global/support/security/Synology_SA_17_26_Office · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11150 · Security Note