Lucene search

SynologyCVE-2018-13297

HistoryApr 01, 2019 - 3:29 p.m.

CVE-2018-13297

2019-04-0115:29:00

CWE-200

synology

web.nvd.nist.gov

cve-2018-13297

information exposure vulnerability

syno.synologydrive.files

synology drive

remote attackers

sensitive system information

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

48.6%

JSON

Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsm_path parameter.

Affected configurations

Nvd

Node

synologydriveRange<1.1.2-10562

VendorProductVersionCPE
synologydrive*cpe:2.3:a:synology:drive:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
synology	drive	*	cpe:2.3:a:synology:drive::::::::

CNA Affected

[
  {
    "product": "Drive",
    "vendor": "Synology",
    "versions": [
      {
        "lessThan": "1.1.2-10562",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.synology.com/security/advisory/Synology_SA_18_50

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

48.6%

JSON

Related for CVE-2018-13297