CVE-2018-8914 HIGH

CVE-2018-8914

Vendor Synology

Product Media Server

Weakness CWE-89 · SQLi

Published May 10, 2018

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter.

Key dates

02Disclosure timeline

May 10, 2018 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-8914 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

Identifiers

CVE CVE-2018-8914

CWE CWE-89

CVSS 7.3 / HIGH

Affected versions

Vendor Synology

Product Media Server

Affected ≥ unspecified and < 1.7.6-2842

Vendor Synology

Product Media Server

Affected ≥ unspecified and < 1.4-2654

CVE-2018-8914

01Description

02Disclosure timeline

03References

04Related CVE