CVE-2015-9102

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.fortiguard.com/zeroday/FG-VD-15-103	Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-104	Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-109	Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-112	Third Party Advisory
https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-06-30 13:29

Updated : 2024-02-04 19:29

NVD link : CVE-2015-9102

Mitre link : CVE-2015-9102

CVE.ORG link : CVE-2015-9102

JSON object : View

Products Affected

synology

photo_station

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2015-9102", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2017-06-30T13:29:00.177", "references": [{"url": "http://www.fortiguard.com/zeroday/FG-VD-15-103", "tags": ["Third Party Advisory"], "source": "security@synology.com"}, {"url": "http://www.fortiguard.com/zeroday/FG-VD-15-104", "tags": ["Third Party Advisory"], "source": "security@synology.com"}, {"url": "http://www.fortiguard.com/zeroday/FG-VD-15-109", "tags": ["Third Party Advisory"], "source": "security@synology.com"}, {"url": "http://www.fortiguard.com/zeroday/FG-VD-15-112", "tags": ["Third Party Advisory"], "source": "security@synology.com"}, {"url": "https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962", "tags": ["Vendor Advisory"], "source": "security@synology.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security@synology.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos."}, {"lang": "es", "value": "Varias vulnerabilidades de XSS (cross-site scripting) en Synology Photo Station versi\u00f3n 6.0 y anteriores a la 6.0-2638, versi\u00f3n 6.3 y anteriores a la 6.3-2962, permiten a atacantes remotos autenticados inyectar secuencias de comandos web o HTML a trav\u00e9s del (1) nombre del \u00e1lbum (2) nombre de las im\u00e1genes subidas, (3) descripci\u00f3n de fotos, o (4) etiqueta de las fotos."}], "lastModified": "2019-10-09T23:15:54.510", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D392B8A-1DCF-4B74-921B-4A2A55F794DE", "versionEndIncluding": "6.3-2960"}], "operator": "OR"}]}], "sourceIdentifier": "security@synology.com"}