Path Traversal vulnerability in Synology USB Copy Software
CVE-2022-27621

3.8LOW

Key Information:

Vendor

Synology
Status
Usb Copy
Vendor
CVE Published:
3 August 2022

What is CVE-2022-27621?

A vulnerability exists in the webapi component of Synology USB Copy, allowing remote authenticated users to manipulate file paths and gain unauthorized access to potentially sensitive files. This improper limitation of pathname can lead to arbitrary file read or write operations, posing security risks to users who have access to the affected software. Users are advised to upgrade to the latest version to mitigate this issue. For more detailed information, refer to the Synology security advisory.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

USB Copy < 2.2.0-1086

References

https://www.synology.com/security/advisory/Synology_SA_22_14
x_refsource_CONFIRM

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.