Synology-SA-18:36 DSM

Publish Time: 2018-07-12 16:41:54 UTC+8

Last Updated: 2018-10-31 22:47:23 UTC+8

Severity
Moderate
Status
Resolved

Abstract

A vulnerability allows remote authenticated users to obtain sensitive information via a susceptible version of Synology DiskStation Manager (DSM).

Affected Products

Product Severity Fixed Release Availability
DSM 6.2 Moderate Upgrade to 6.2-23739-2 or above
DSM 6.1 Moderate Upgrade to 6.1.7-15284-2 or above
DSM 6.0 Moderate Will not fix
DSM 5.2 Moderate Pending
SkyNAS Moderate Will not fix
VS960HD Moderate Pending

Mitigation

None

Detail

  • CVE-2018-13281
    • Severity: Moderate
    • CVSS3 Base Score: 4.3
    • CVSS3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    • Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the file_path parameter.

Revision

Revision Date Description
1 2018-07-12 Initial public release.
2 2018-10-31 Disclosed vulnerability details.