PT-2018-18723 · Synology · Synology Photo Station

Thomas Fady · Published 2018-06-08 · Updated 2019-10-09 · CVE-2018-8925

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.8.5-3471 Synology Photo Station versions prior to 6.3-2975

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators. This can be achieved via the username, password, admin, action, uid, or modify admin parameter.

Recommendations For Synology Photo Station versions prior to 6.8.5-3471, update to version 6.8.5-3471 or later. For Synology Photo Station versions prior to 6.3-2975, update to version 6.3-2975 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-8925

Affected Products

Synology Photo Station

References · 3

• https://osv.dev/vulnerability/CVE-2018-8925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8925 · Security Note
• https://synology.com/zh-tw/support/security/Synology_SA_18_15 · Vendor Advisory