Session Fixation Flaw in Access Control for Synology Photo Station
CVE-2022-22681

8.1HIGH

Key Information:

Vendor
Synology
Status
Photo Station
Vendor
CVE Published:
6 July 2022

Summary

A session fixation vulnerability exists in the access control management of Synology Photo Station prior to version 6.8.16-3506. This flaw allows remote attackers to exploit session management by bypassing the established security constraints. Attackers can manipulate session information via unspecified vectors, potentially granting unauthorized access to sensitive user data. Users are urged to update their software to mitigate any risks associated with this vulnerability.

Affected Version(s)

Photo Station < 6.8.16-3506

References

https://www.synology.com/security/advisory/Synology_SA_21_26
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.