CVE-2010-2453

2010-09-2917:00:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2010-2453

xss

synology disk station

dsm3.0-1337

ftp server

web commands injection

5.9 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

48.1%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before DSM3.0-1337 allow remote attackers to inject arbitrary web script or HTML by connecting to the FTP server and providing a crafted (1) USER or (2) PASS command, which is written by the FTP logging module to a web-interface log window, related to a “web commands injection” issue.

CPENameOperatorVersion
synology:dsmsynology dsmeq2.2-0942
synology:dsmsynology dsmeq2.2-1041
synology:dsmsynology dsmeq2.2-1042
synology:dsmsynology dsmeq2.2-1045
synology:dsmsynology dsmeq2.3-1139
synology:dsmsynology dsmeq2.3-1141
synology:dsmsynology dsmeq2.3-1144
synology:dsmsynology dsmeq2.3-1157
synology:dsmsynology dsmeq2.3-1161
synology:dsmsynology dsmeq3.0-1334

CPE	Name	Operator	Version
synology:dsm	synology dsm	eq	2.2-0942
synology:dsm	synology dsm	eq	2.2-1041
synology:dsm	synology dsm	eq	2.2-1042
synology:dsm	synology dsm	eq	2.2-1045
synology:dsm	synology dsm	eq	2.3-1139
synology:dsm	synology dsm	eq	2.3-1141
synology:dsm	synology dsm	eq	2.3-1144
synology:dsm	synology dsm	eq	2.3-1157
synology:dsm	synology dsm	eq	2.3-1161
synology:dsm	synology dsm	eq	3.0-1334