PT-2017-14549 · Synology · Synology Mailplus Server

Published 2017-12-27 · Updated 2018-01-10 · CVE-2017-16768

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synology MailPlus Server versions prior to 1.4.0-0415

Description A cross-site scripting (XSS) issue exists in the User Policy editor, allowing remote authenticated users to inject arbitrary HTML via the name parameter. This could potentially lead to unauthorized actions on the affected system.

Recommendations For versions prior to 1.4.0-0415, update to version 1.4.0-0415 or later to resolve the issue. As a temporary workaround, consider restricting access to the User Policy editor to minimize the risk of exploitation. Avoid using the name parameter in the affected editor until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16768

Affected Products

Synology Mailplus Server

References · 3

• https://synology.com/en-global/support/security/Synology_SA_17_81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16768 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16768 · Vendor Advisory