Lucene search

SynologyCVE-2017-15895

HistoryDec 08, 2017 - 4:29 p.m.

CVE-2017-15895

2017-12-0816:29:00

CWE-22

synology

web.nvd.nist.gov

cve-2017-15895

directory traversal vulnerability

synology router manager

srm

remote authenticated users

arbitrary files

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

26.5%

JSON

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.

Affected configurations

Nvd

Node

synologyrouter_managerRange<1.1.5-6542-4

VendorProductVersionCPE
synologyrouter_manager*cpe:2.3:a:synology:router_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
synology	router_manager	*	cpe:2.3:a:synology:router_manager::::::::

CNA Affected

[
  {
    "product": "Synology Router Manager (SRM)",
    "vendor": "Synology",
    "versions": [
      {
        "status": "affected",
        "version": "before 1.1.5-6542-4"
      }
    ]
  }
]

References

www.synology.com/en-global/support/security/Synology_SA_17_71_SRM

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

26.5%

JSON

Related for CVE-2017-15895