Server-Side Request Forgery in Synology Photo Station
CVE-2017-12071

6.5MEDIUM

Key Information:

Vendor

Synology
Status
Synology Photo Station
Vendor
CVE Published:
8 September 2017

What is CVE-2017-12071?

An SSRF vulnerability exists in file_upload.php of Synology Photo Station prior to versions 6.7.4-3433 and 6.3-2968, allowing authenticated remote users to manipulate the url parameter to retrieve arbitrary local files from the server. This could lead to sensitive information exposure and necessitates prompt security measures to prevent exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Synology Photo Station before 6.7.4-3433 and 6.3-2968

References

https://www.synology.com/en-global/support/security/Synol...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.