CVE-2023-0142

6.5MEDIUM

Key Information:

Vendor
Synology
Status
Diskstation Manager (dsm)
Unified Controller (dsmuc)
Synology Router Manager (srm)
Vendor
CVE Published:
13 June 2023

Summary

Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary files via unspecified vectors.

Affected Version(s)

DiskStation Manager (DSM) 7.2

DiskStation Manager (DSM) 7.1 < 7.1-42661

DiskStation Manager (DSM) 7.0 < 7.0.1-42218-7

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory
https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Chanyoung So
.