CVE-2018-13287 — Incorrect Default Permissions in Synology Router Manager

CWE-276 — Incorrect Default Permissions4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 49.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Synology Router ManagerSynology Router Manager
Timeline
PublishedApr 1
Latest updateMay 13

Description

Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDsynology/router_manager< 1.1.7-6941-1
▶CVEListV5synology/synology_router_managerunspecified — 1.1.7-6941-1

🔴Vulnerability Details

2
GHSA
GHSA-qfhf-9ghp-mgv4: Incorrect default permissions vulnerability in synouser↗2022-05-13
▶
CVEList
CVE-2018-13287: Incorrect default permissions vulnerability in synouser↗2019-04-01
▶

💬Community

1
Bugzilla
CVE-2019-13287 xpdf: out-of-bounds read in function SplashXPath::strokeAdjust() in splash/SplashXPath.cc↗2019-07-09
▶
CVE-2018-13287 — Incorrect Default Permissions | cvebase