CVE-2018-8917 MEDIUM

CVE-2018-8917

Vendor Synology
Product DiskStation Manager (DSM)
Weakness CWE-79 · XSS
Published December 24, 2018
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter.

Key dates

02Disclosure timeline

December 24, 2018 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-49638 WordPress Risk Warning Bar plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2021-42118 Stored XSS in TopEase CVE-2023-38121 Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution Vulnerability CVE-2024-1161 Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes CVE-2023-37488 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration