CVE-2022-22679 MEDIUM

CVE-2022-22679

Vendor Synology
Product DiskStation Manager (DSM)
Weakness CWE-22 · Path traversal
Published February 7, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors.

Key dates

02Disclosure timeline

February 7, 2022 CVE published
September 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-1793 Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read CVE-2021-21102 Adobe Illustrator DOCX file parsing directory traversal vulnerability could lead to remote code execution CVE-2026-42351 pygeoapi: Path Traversal in STAC FileSystemProvider CVE-2025-42894 Path Traversal vulnerability in SAP Business Connector CVE-2024-34384 WordPress Sina Extension for Elementor plugin <= 3.5.1 - Local File Inclusion vulnerability