Server-Side Request Forgery Vulnerability in Synology DiskStation Manager
CVE-2022-27622

4.1MEDIUM

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
25 October 2022

What is CVE-2022-27622?

A Server-Side Request Forgery (SSRF) vulnerability exists in the Package Center functionality of Synology DiskStation Manager (DSM), allowing remote authenticated users to exploit this weakness. This exploitation can lead to unauthorized access to sensitive intranet resources through unspecified vectors, potentially exposing private data and internal network services.

Affected Version(s)

DiskStation Manager (DSM) < 7.1-42661

References

https://www.synology.com/security/advisory/Synology_SA_22_18

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.