Sign-up

ID

VAR-202106-1479


CVE

CVE-2021-29088


TITLE

Synology DiskStation Manager  Traversal Vulnerability in Japan

Trust: 0.8

sources: JVNDB: JVNDB-2021-007553

DESCRIPTION

Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors. Synology DiskStation Manager (DSM) Contains a path traversal vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Synology DiskStation Manager (DSM) is an operating system for network storage servers (NAS) developed by Synology, Taiwan. The operating system can manage data, documents, photos, music and other information

Trust: 1.71

sources: NVD: CVE-2021-29088 // JVNDB: JVNDB-2021-007553 // VULHUB: VHN-388628

AFFECTED PRODUCTS

vendor:synologymodel:diskstation managerscope:ltversion:6.2.4-25553

Trust: 1.0

vendor:synologymodel:diskstation managerscope:eqversion: -

Trust: 0.8

vendor:synologymodel:diskstation managerscope:eqversion:6.2.4-25553

Trust: 0.8

sources: JVNDB: JVNDB-2021-007553 // NVD: CVE-2021-29088

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-29088
value: HIGH

Trust: 1.0

security@synology.com: CVE-2021-29088
value: HIGH

Trust: 1.0

NVD: CVE-2021-29088
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202106-060
value: HIGH

Trust: 0.6

VULHUB: VHN-388628
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-29088
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-388628
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-29088
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 2.0

OTHER: JVNDB-2021-007553
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-388628 // JVNDB: JVNDB-2021-007553 // CNNVD: CNNVD-202106-060 // NVD: CVE-2021-29088 // NVD: CVE-2021-29088

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.1

problemtype:Path traversal (CWE-22) [ Other ]

Trust: 0.8

sources: VULHUB: VHN-388628 // JVNDB: JVNDB-2021-007553 // NVD: CVE-2021-29088

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202106-060

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202106-060

PATCH

title:Synology-SA-21url:https://www.synology.com/ja-jp/security/advisory/Synology_SA_21_03

Trust: 0.8

title:Synology DiskStation Manager Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=153078

Trust: 0.6

sources: JVNDB: JVNDB-2021-007553 // CNNVD: CNNVD-202106-060

EXTERNAL IDS

db:NVDid:CVE-2021-29088

Trust: 3.3

db:JVNDBid:JVNDB-2021-007553

Trust: 0.8

db:CNNVDid:CNNVD-202106-060

Trust: 0.6

db:VULHUBid:VHN-388628

Trust: 0.1

sources: VULHUB: VHN-388628 // JVNDB: JVNDB-2021-007553 // CNNVD: CNNVD-202106-060 // NVD: CVE-2021-29088

REFERENCES

url:https://www.synology.com/security/advisory/synology_sa_21_03

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-29088

Trust: 0.8

sources: VULHUB: VHN-388628 // JVNDB: JVNDB-2021-007553 // CNNVD: CNNVD-202106-060 // NVD: CVE-2021-29088

SOURCES

db:VULHUBid:VHN-388628
db:JVNDBid:JVNDB-2021-007553
db:CNNVDid:CNNVD-202106-060
db:NVDid:CVE-2021-29088

LAST UPDATE DATE

2024-08-14T13:23:30.966000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-388628date:2021-06-09T00:00:00
db:JVNDBid:JVNDB-2021-007553date:2022-02-15T08:56:00
db:CNNVDid:CNNVD-202106-060date:2021-06-10T00:00:00
db:NVDid:CVE-2021-29088date:2021-06-09T17:12:10.177

SOURCES RELEASE DATE

db:VULHUBid:VHN-388628date:2021-06-01T00:00:00
db:JVNDBid:JVNDB-2021-007553date:2022-02-15T00:00:00
db:CNNVDid:CNNVD-202106-060date:2021-06-01T00:00:00
db:NVDid:CVE-2021-29088date:2021-06-01T14:15:09.767