Vulnerabilities > CVE-2021-34808 - Server-Side Request Forgery (SSRF) vulnerability in Synology Media Server

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

synology

CWE-918

NVD

Published: 2021-06-18

Updated: 2021-06-23

Summary

Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.

Vulnerable Configurations

Part	Description	Count
Application	Synology Synology Media Server - Synology Media Server 1.0-2260 Synology Media Server 1.1-2325 Synology Media Server 1.1-2327 Synology Media Server 1.1-2406 Synology Media Server 1.1-2407 Synology Media Server 1.1-2411 Synology Media Server 1.2-2489 Synology Media Server 1.2-2491 Synology Media Server 1.2-2492 Synology Media Server 1.3-2575 Synology Media Server 1.4 Synology Media Server 1.4-2629 Synology Media Server 1.4-2642 Synology Media Server 1.4-2644 Synology Media Server 1.4-2649 Synology Media Server 1.4-2653 Synology Media Server 1.4-2654 Synology Media Server 1.5-2762 Synology Media Server 1.6.0-2766 Synology Media Server 1.6.1-2767 Synology Media Server 1.6.2-2770 Synology Media Server 1.7 Synology Media Server 1.7.0-2810 Synology Media Server 1.7.1-2810 Synology Media Server 1.7.1-2820 Synology Media Server 1.7.2-2830 Synology Media Server 1.7.3-2841 Synology Media Server 1.7.4-2852 Synology Media Server 1.7.5-2854 Synology Media Server 1.7.6-2842 Synology Media Server 1.7.7-2855 Synology Media Server 1.7.8-2844 Synology Media Server 1.7.9-2858 Synology Media Server 1.8.1-2876	35

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

References

https://www.synology.com/security/advisory/Synology_SA_21_10