PT-2017-7552 · Synology · Synology Video Station

Published 2017-06-30 · Updated 2019-10-09 · CVE-2015-9105

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Synology Video Station versions 1.2 before 1.2-0455 Synology Video Station versions 1.5 before 1.5-0772 Synology Video Station versions 1.6 before 1.6-0847

Description The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the file name or collection name of videos.

Recommendations For Synology Video Station versions 1.2 before 1.2-0455, update to version 1.2-0455 or later. For Synology Video Station versions 1.5 before 1.5-0772, update to version 1.5-0772 or later. For Synology Video Station versions 1.6 before 1.6-0847, update to version 1.6-0847 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-9105

Affected Products

Synology Video Station

References · 4

• https://synology.com/en-global/support/security/Video_station_1_5_0772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-9105 · Security Note
• http://fortiguard.com/zeroday/FG-VD-15-108 · Note
• http://fortiguard.com/zeroday/FG-VD-15-107 · Note