Sign-up

ID

VAR-202202-0588


CVE

CVE-2021-43927


TITLE

Synology DiskStation Manager  In  SQL  Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-004927

DESCRIPTION

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. Synology DiskStation Manager (DSM) for, SQL There is an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2021-43927 // JVNDB: JVNDB-2022-004927 // VULHUB: VHN-406552

AFFECTED PRODUCTS

vendor:synologymodel:diskstation managerscope:ltversion:7.0.1-42218-2

Trust: 1.0

vendor:synologymodel:diskstation managerscope:gteversion:7.0

Trust: 1.0

vendor:synologymodel:diskstation managerscope:ltversion:6.2.4-25556-3

Trust: 1.0

vendor:synologymodel:diskstation managerscope:gteversion:6.2

Trust: 1.0

vendor:synologymodel:diskstation managerscope:eqversion:7.0.1-42218-2

Trust: 0.8

vendor:synologymodel:diskstation managerscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-004927 // NVD: CVE-2021-43927

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-43927
value: CRITICAL

Trust: 1.0

security@synology.com: CVE-2021-43927
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-43927
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202202-510
value: CRITICAL

Trust: 0.6

VULHUB: VHN-406552
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-43927
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-406552
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-43927
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

security@synology.com: CVE-2021-43927
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 1.2
impactScore: 3.4
version: 3.1

Trust: 1.0

NVD: CVE-2021-43927
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-406552 // JVNDB: JVNDB-2022-004927 // CNNVD: CNNVD-202202-510 // NVD: CVE-2021-43927 // NVD: CVE-2021-43927

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.1

problemtype:SQL injection (CWE-89) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-406552 // JVNDB: JVNDB-2022-004927 // NVD: CVE-2021-43927

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-510

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-202202-510

PATCH

title:Synology-SA-22url:https://www.synology.com/en-global/security/advisory/Synology_SA_22_01

Trust: 0.8

title:Synology DiskStation Manager SQL Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=181957

Trust: 0.6

sources: JVNDB: JVNDB-2022-004927 // CNNVD: CNNVD-202202-510

EXTERNAL IDS

db:NVDid:CVE-2021-43927

Trust: 3.3

db:JVNDBid:JVNDB-2022-004927

Trust: 0.8

db:CNNVDid:CNNVD-202202-510

Trust: 0.6

db:VULHUBid:VHN-406552

Trust: 0.1

sources: VULHUB: VHN-406552 // JVNDB: JVNDB-2022-004927 // CNNVD: CNNVD-202202-510 // NVD: CVE-2021-43927

REFERENCES

url:https://www.synology.com/security/advisory/synology_sa_22_01

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-43927

Trust: 1.4

sources: VULHUB: VHN-406552 // JVNDB: JVNDB-2022-004927 // CNNVD: CNNVD-202202-510 // NVD: CVE-2021-43927

SOURCES

db:VULHUBid:VHN-406552
db:JVNDBid:JVNDB-2022-004927
db:CNNVDid:CNNVD-202202-510
db:NVDid:CVE-2021-43927

LAST UPDATE DATE

2024-11-23T22:32:56.753000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-406552date:2022-02-10T00:00:00
db:JVNDBid:JVNDB-2022-004927date:2023-05-11T08:28:00
db:CNNVDid:CNNVD-202202-510date:2022-02-15T00:00:00
db:NVDid:CVE-2021-43927date:2024-11-21T06:30:00.863

SOURCES RELEASE DATE

db:VULHUBid:VHN-406552date:2022-02-07T00:00:00
db:JVNDBid:JVNDB-2022-004927date:2023-05-11T00:00:00
db:CNNVDid:CNNVD-202202-510date:2022-02-07T00:00:00
db:NVDid:CVE-2021-43927date:2022-02-07T03:15:07.097