PT-2019-8964 · Synology · Synology Calendar

Chun Han Hsiao · Published 2019-04-01 · Updated 2019-10-09 · CVE-2018-13299

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Synology Calendar versions prior to 2.2.2-0532

Description A relative path traversal issue exists in the Attachment Uploader of Synology Calendar, allowing remote authenticated users to upload arbitrary files by manipulating the filename parameter.

Recommendations For versions prior to 2.2.2-0532, update to version 2.2.2-0532 or later to resolve the issue.

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2018-13299

Affected Products

Synology Calendar

References · 3

• https://synology.com/security/advisory/Synology_SA_18_54 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13299 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13299 · Vendor Advisory