Server-Side Request Forgery in Synology Photo Station
CVE-2017-12071

6.5MEDIUM

Key Information:

Vendor
Synology
Status
Synology Photo Station
Vendor
CVE Published:
8 September 2017

Summary

An SSRF vulnerability exists in file_upload.php of Synology Photo Station prior to versions 6.7.4-3433 and 6.3-2968, allowing authenticated remote users to manipulate the url parameter to retrieve arbitrary local files from the server. This could lead to sensitive information exposure and necessitates prompt security measures to prevent exploitation.

Affected Version(s)

Synology Photo Station before 6.7.4-3433 and 6.3-2968

References

https://www.synology.com/en-global/support/security/Synol...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.