6.5

CVE-2017-11149

Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Synology ≫ Download Station Version 3.2-2295
Synology ≫ Download Station Version 3.3-2382
Synology ≫ Download Station Version 3.3-2383
Synology ≫ Download Station Version 3.3-2386
Synology ≫ Download Station Version 3.4-2477
Synology ≫ Download Station Version 3.4-2478
Synology ≫ Download Station Version 3.4-2480
Synology ≫ Download Station Version 3.4-2485
Synology ≫ Download Station Version 3.4-2486
Synology ≫ Download Station Version 3.4-2489
Synology ≫ Download Station Version 3.4-2490
Synology ≫ Download Station Version 3.4-2514
Synology ≫ Download Station Version 3.4-2555
Synology ≫ Download Station Version 3.4-2557
Synology ≫ Download Station Version 3.4-2558
Synology ≫ Download Station Version 3.5-2638
Synology ≫ Download Station Version 3.5-2705
Synology ≫ Download Station Version 3.5-2706
Synology ≫ Download Station Version 3.5-2955
Synology ≫ Download Station Version 3.5-2956
Synology ≫ Download Station Version 3.5-2962
Synology ≫ Download Station Version 3.5-2963
Synology ≫ Download Station Version 3.5-2967
Synology ≫ Download Station Version 3.5-2968
Synology ≫ Download Station Version 3.5-2970
Synology ≫ Download Station Version 3.5-2973
Synology ≫ Download Station Version 3.5-2980
Synology ≫ Download Station Version 3.5-2982
Synology ≫ Download Station Version 3.8.0-3416
Synology ≫ Download Station Version 3.8.1-3420
Synology ≫ Download Station Version 3.8.2-3455
Synology ≫ Download Station Version 3.8.3-3458
Synology ≫ Download Station Version 3.8.4-3468
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.6% 0.726
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station
Vendor Advisory