Lucene search

SynologyCVELIST:CVE-2022-43748

HistoryOct 26, 2022 - 10:05 a.m.

CVE-2022-43748

2022-10-2610:05:13

CWE-22

synology

www.cve.org

path traversal

vulnerability

file operation management

remote attackers

arbitrary files

unspecified vectors

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

40.8%

JSON

Improper limitation of a pathname to a restricted directory (‘Path Traversal’) vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors.

CNA Affected

[
  {
    "vendor": "Synology",
    "product": "Presto File Server",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.1.2-1601",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

www.synology.com/security/advisory/Synology_SA_22_19

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

40.8%

JSON

Related for CVELIST:CVE-2022-43748