CVE-2022-27610 — Path Traversal in Synology Diskstation Manager

CWE-22 — Path Traversal3 documents3 sources
Severity
8.1HIGHNVD
CNA6.5
EPSS
1.3%
top 20.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Synology Diskstation Manager
Timeline
PublishedJul 27
Latest updateJul 28

Description

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5synology/diskstation_managerunspecified — 6.2.3-25423
▶NVDsynology/diskstation_manager6.2 — 6.2.3-25423

🔴Vulnerability Details

2
GHSA
GHSA-c4wx-gc8f-7fj9: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM)↗2022-07-28
▶
CVEList
CVE-2022-27610: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM)↗2022-07-27
▶