Skip to content

CVE-2013-6955 webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and...

HighCVSS 10.0 EPSS 84.6% Framework module Public exploit
Published
Updated
Exploit status
Public exploit available
Sign in for asset impact Search another CVE

Description

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.

Affected products

ProductAffected versionsFixed in
Synology diskstation manager = 4.0 No fix listed
Synology diskstation manager = 4.2 No fix listed
Synology diskstation manager = 4.3 No fix listed
Synology diskstation manager = 4.3-3810 No fix listed

References

  • VU#615910 third-party-advisory us-government-resource