PT-2022-15632 · Synology · Synology Calendar

Cq674350529 + 1 · Published 2022-07-26 · Updated 2022-08-01 · CVE-2022-22686

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Calendar versions prior to 2.3.4-0631

Description A Cross-Site Request Forgery (CSRF) issue in the webapi component allows remote authenticated users to hijack the authentication of administrators via unspecified vectors. This could potentially lead to unauthorized actions being taken on behalf of the administrators.

Recommendations For versions prior to 2.3.4-0631, update to version 2.3.4-0631 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication checks or restrictions on the webapi component to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-22686

Affected Products

Synology Calendar

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-22686 · Security Note
• https://synology.com/security/advisory/Synology_SA_20_07 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22686 · Vendor Advisory
• https://t.me/cvenotify/33753 · Telegram Post
• https://t.me/cibsecurity/46968 · Telegram Post