Server-Side Request Forgery in Synology Media Server by Synology
CVE-2021-34808

5.8MEDIUM

Key Information:

Vendor
Synology
Status
Media Server
Vendor
CVE Published:
18 June 2021

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the cgi component of Synology Media Server versions prior to 1.8.3-2881, enabling remote attackers to manipulate server requests that target intranet resources. This can lead to unauthorized access to sensitive internal systems and can be exploited through various unspecified vectors, posing significant security risks for users relying on this media server.

Affected Version(s)

Media Server < 1.8.3-2881

References

https://www.synology.com/security/advisory/Synology_SA_21_10
x_refsource_CONFIRM

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.