- Description
- Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors.
- Source
- security@synology.com
- NVD status
- Analyzed
- Products
- diskstation_manager
CVSS 3.1
- Type
- Secondary
- Base score
- 7.5
- Impact score
- 5.9
- Exploitability score
- 1.6
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security@synology.com
- CWE-295
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "299B3A47-D265-4DDC-86C5-F2169C46A6DD",
"versionEndExcluding": "7.1.1-42962-8",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8F12B265-8B22-4F52-92D9-910B4FDF85DE",
"versionEndExcluding": "7.2.1-69057-7",
"versionStartIncluding": "7.2.1-69057",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9C2F434A-56E9-4D31-85D1-B2AB60605908",
"versionEndExcluding": "7.2.2-72806-3",
"versionStartIncluding": "7.2.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]