PT-2023-26877 · Synology · Music Station

Fredoun · Published 2023-11-03 · Updated 2023-11-14 · CVE-2023-39299

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Music Station versions prior to 4.8.11 Music Station versions prior to 5.1.16 Music Station versions prior to 5.3.23

Description A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.

Recommendations For Music Station versions prior to 4.8.11, update to version 4.8.11 or later. For Music Station versions prior to 5.1.16, update to version 5.1.16 or later. For Music Station versions prior to 5.3.23, update to version 5.3.23 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-39299

Affected Products

Music Station

References · 5

• https://qnap.com/en/security-advisory/qsa-23-61 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39299 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39299 · Vendor Advisory
• https://twitter.com/CVEnew/status/1720481389412544567 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1720533943055716646 · Twitter Post