Synology-SA-18:27 Universal Search
Publish Time: 2018-05-31 10:52:48 UTC+8
Last Updated: 2018-07-05 11:03:26 UTC+8
- Severity
- Moderate
- Status
- Resolved
Abstract
A vulnerability allows remote authenticated users to bypass permission checks for directories via a susceptible version of Synology Universal Search.
Affected Products
| Product | Severity | Fixed Release Availability |
|---|---|---|
| Universal Search | Moderate | Upgrade to 1.0.5-0135 or above. |
Mitigation
None
Detail
- CVE-2017-16773
- Severity: Moderate
- CVSS3 Base Score: 6.5
- CVSS3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission checks for directories in POSIX mode.
Revision
| Revision | Date | Description |
|---|---|---|
| 1 | 2018-05-31 | Initial public release. |
| 2 | 2018-07-05 | Disclosed vulnerability details. |