Sign-up

ID

VAR-201906-0948


CVE

CVE-2019-11829


TITLE

Synology Calendar In OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-005901

DESCRIPTION

OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header. Synology Calendar is a file protection program run on Synology NAS (Network Storage Server) devices by Synology, a Taiwan-based company. The vulnerability stems from the fact that the network system or product does not correctly filter special characters, commands, etc. in the process of constructing executable commands of the operating system from external input data

Trust: 1.71

sources: NVD: CVE-2019-11829 // JVNDB: JVNDB-2019-005901 // VULHUB: VHN-143514

AFFECTED PRODUCTS

vendor:synologymodel:calendarscope:ltversion:2.3.1-0617

Trust: 1.8

sources: JVNDB: JVNDB-2019-005901 // NVD: CVE-2019-11829

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-11829
value: CRITICAL

Trust: 1.0

security@synology.com: CVE-2019-11829
value: HIGH

Trust: 1.0

NVD: CVE-2019-11829
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201906-1158
value: CRITICAL

Trust: 0.6

VULHUB: VHN-143514
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-11829
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-143514
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-11829
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

security@synology.com: CVE-2019-11829
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 3.4
version: 3.1

Trust: 1.0

NVD: CVE-2019-11829
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-143514 // JVNDB: JVNDB-2019-005901 // CNNVD: CNNVD-201906-1158 // NVD: CVE-2019-11829 // NVD: CVE-2019-11829

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.9

sources: VULHUB: VHN-143514 // JVNDB: JVNDB-2019-005901 // NVD: CVE-2019-11829

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201906-1158

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201906-1158

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-005901

PATCH
title:Synology-SA-19:12 Calendarurl:https://www.synology.com/security/advisory/Synology_SA_19_12
Trust: 0.8
title:Synology Calendar Fixes for operating system command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=94246
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-005901 // 
            
            
            
            CNNVD: CNNVD-201906-1158

EXTERNAL IDS
db:NVDid:CVE-2019-11829
Trust: 2.5
db:JVNDBid:JVNDB-2019-005901
Trust: 0.8
db:CNNVDid:CNNVD-201906-1158
Trust: 0.7
db:VULHUBid:VHN-143514
Trust: 0.1
sources:
            
            
            VULHUB: VHN-143514 // 
            
            
            
            JVNDB: JVNDB-2019-005901 // 
            
            
            
            CNNVD: CNNVD-201906-1158 // 
            
            
            
            NVD: CVE-2019-11829

REFERENCES
url:https://www.synology.com/security/advisory/synology_sa_19_12
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-11829
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11829
Trust: 0.8
sources:
            
            
            VULHUB: VHN-143514 // 
            
            
            
            JVNDB: JVNDB-2019-005901 // 
            
            
            
            CNNVD: CNNVD-201906-1158 // 
            
            
            
            NVD: CVE-2019-11829

SOURCES
db:VULHUBid:VHN-143514
db:JVNDBid:JVNDB-2019-005901
db:CNNVDid:CNNVD-201906-1158
db:NVDid:CVE-2019-11829

LAST UPDATE DATE
2024-11-23T22:41:29.007000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-143514date:2023-01-30T00:00:00
db:JVNDBid:JVNDB-2019-005901date:2019-07-03T00:00:00
db:CNNVDid:CNNVD-201906-1158date:2019-07-03T00:00:00
db:NVDid:CVE-2019-11829date:2024-11-21T04:21:50.717

SOURCES RELEASE DATE
db:VULHUBid:VHN-143514date:2019-06-30T00:00:00
db:JVNDBid:JVNDB-2019-005901date:2019-07-03T00:00:00
db:CNNVDid:CNNVD-201906-1158date:2019-06-30T00:00:00
db:NVDid:CVE-2019-11829date:2019-06-30T15:15:09.917