PT-2018-12789 · Samsung · Samsung Syncthru Web Service

Published 2018-08-03 · Updated 2018-09-27 · CVE-2018-14904

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Samsung Syncthru Web Service version V4.05.61

Description The issue concerns multiple unauthenticated XSS attacks. These attacks can be executed on several parameters, such as ruiFw pid.

Recommendations For Samsung Syncthru Web Service version V4.05.61, consider restricting access to the vulnerable parameters until a patch is available. As a temporary workaround, avoid using the parameter ruiFw pid in the affected API endpoints.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-14904

Affected Products

Samsung Syncthru Web Service

References · 3

• 🔥 https://medium.com/stolabs/security-issues-on-samsung-syncthru-web-service-cc86467d2df · Exploit
• https://osv.dev/vulnerability/CVE-2018-14904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14904 · Security Note