PT-2018-18724 · Synology · Synology Photo Station

Thomas Fady · Published 2018-06-08 · Updated 2019-10-09 · CVE-2018-8926

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.8.5-3471 Synology Photo Station versions prior to 6.3-2975

Description The issue is related to a permissive regular expression vulnerability in the synophoto dsm user component of Synology Photo Station. This vulnerability allows remote authenticated users to conduct privilege escalation attacks. The attack is carried out via the fullname parameter.

Recommendations For versions prior to 6.8.5-3471, update to version 6.8.5-3471 or later. For versions prior to 6.3-2975, update to version 6.3-2975 or later.

Fix

Weakness Enumeration

CWE-625

Related Identifiers

CVE-2018-8926

Affected Products

Synology Photo Station

References · 3

• https://osv.dev/vulnerability/CVE-2018-8926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8926 · Security Note
• https://synology.com/zh-tw/support/security/Synology_SA_18_15 · Vendor Advisory