CVE-2017-11149

moderate-risk

Published 2017-08-14

Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.

Do I need to act?

-

0.18% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

6

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Download Station

Affected Vendors

Synology

References (2)

Vendor Advisory https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_S...

Vendor Advisory https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_S...

48

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 23/34 · High