CVE-2023-47803

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-47803
A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings functionality. This allows remote attackers to read specific files containing non-sensitive information via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_23_15 Vendor Advisory
https://www.synology.com/en-global/security/advisory/Synology_SA_23_15 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:synology:bc500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:bc500:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:synology:tc500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:tc500:-:*:*:*:*:*:*:*
History

04 Mar 2025, 18:43

Type Values Removed Values Added
First Time Synology tc500 Firmware
Synology bc500
Synology bc500 Firmware
Synology tc500
Synology
CPE cpe:2.3:o:synology:tc500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:tc500:-:*:*:*:*:*:*:*
cpe:2.3:h:synology:bc500:-:*:*:*:*:*:*:*
cpe:2.3:o:synology:bc500_firmware:*:*:*:*:*:*:*:*
References () https://www.synology.com/en-global/security/advisory/Synology_SA_23_15 - () https://www.synology.com/en-global/security/advisory/Synology_SA_23_15 - Vendor Advisory

21 Nov 2024, 08:30

Type Values Removed Values Added
References () https://www.synology.com/en-global/security/advisory/Synology_SA_23_15 - () https://www.synology.com/en-global/security/advisory/Synology_SA_23_15 -
Summary
  • (es) Se encuentra una vulnerabilidad relacionada con la limitación inadecuada de un nombre de ruta a un directorio restringido ("Path Traversal") en la funcionalidad Configuración de idioma. Esto permite a atacantes remotos leer archivos específicos que contienen información no confidencial a través de vectores no especificados. Los siguientes modelos con versiones de firmware de cámara Synology anteriores a 1.0.7-0298 pueden verse afectados: BC500 y TC500.

28 Jun 2024, 10:27

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-28 06:15

Updated : 2025-03-04 18:43

NVD link : CVE-2023-47803

Mitre link : CVE-2023-47803

CVE.ORG link : CVE-2023-47803

JSON object : View

Products Affected

synology

  • tc500_firmware
  • bc500_firmware
  • tc500
  • bc500
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')