Vulnerabilities > CVE-2017-12071 - Server-Side Request Forgery (SSRF) vulnerability in Synology Photo Station

CVSS 4.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

synology

CWE-918

NVD

Published: 2017-09-08

Updated: 2019-10-09

Summary

Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.

Vulnerable Configurations

Part	Description	Count
Application	Synology Synology Photo Station 5.2-2398 Synology Photo Station 5.2-2413 Synology Photo Station 6.0-2636 Synology Photo Station 6.0-2638 Synology Photo Station 6.0-2639 Synology Photo Station 6.0-2640 Synology Photo Station 6.3 Synology Photo Station 6.3-2944 Synology Photo Station 6.3-2958 Synology Photo Station 6.3-2960 Synology Photo Station 6.3-2962 Synology Photo Station 6.3-2963 Synology Photo Station 6.3-2964 Synology Photo Station 6.3-2965 Synology Photo Station 6.3-2967 Synology Photo Station 6.3-2968 Synology Photo Station 6.3-2970 Synology Photo Station 6.3-2971 Synology Photo Station 6.3-2974 Synology Photo Station 6.3-2975 Synology Photo Station 6.3-2976 Synology Photo Station 6.3-2977 Synology Photo Station 6.4-3166 Synology Photo Station 6.5.0-3218 Synology Photo Station 6.5.1-3223 Synology Photo Station 6.5.2-3225 Synology Photo Station 6.5.3-3226 Synology Photo Station 6.6.0-3339 Synology Photo Station 6.6.1-3345 Synology Photo Station 6.6.2-3346 Synology Photo Station 6.6.3-3347 Synology Photo Station 6.7.0-3414 Synology Photo Station 6.7.1-3419 Synology Photo Station 6.7.2-3429 Synology Photo Station 6.7.3-3432	35

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

References

https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation