PT-2018-2682 · Synology · Synology Photo Station

Published 2018-07-23 · Updated 2019-10-09 · CVE-2018-13282

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.8.7-3481

Description The issue is related to a session fixation problem in the SYNO.PhotoStation.Auth component. It allows remote attackers to hijack web sessions via the PHPSESSID parameter, potentially leading to unauthorized access to protected data.

Recommendations For versions prior to 6.8.7-3481, update to version 6.8.7-3481 or later to resolve the issue. As a temporary workaround, consider restricting access to the PHPSESSID parameter to minimize the risk of session hijacking.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2019-01342

CVE-2018-13282

Affected Products

Synology Photo Station

References · 4

• https://synology.com/en-global/support/security/Synology_SA_18_37 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13282 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13282 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01342 · Security Note