« Volver al listado

CVE-2015-9104

Estado: ModificadaMedia (5.4)—

Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Synology — Audio Station

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-9104",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@synology.com",
      "affectedData": [
        {
          "vendor": "Synology",
          "product": "Audio Station",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "status": "affected",
              "version": "5.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-30T13:29:00.253",
  "references": [
    {
      "url": "http://www.fortiguard.com/zeroday/FG-VD-15-106",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@synology.com"
    },
    {
      "url": "https://www.synology.com/en-global/support/security/Audio_Station_5_4_2857",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@synology.com"
    },
    {
      "url": "http://www.fortiguard.com/zeroday/FG-VD-15-106",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.synology.com/en-global/support/security/Audio_Station_5_4_2857",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@synology.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidades de tipo cross-site scripting (XSS) en Synology Audio Station versión 5.1 y anteriores a la 5.1-2550, versión 5.4 y anteriores a la 5.4-2857, permiten a atacantes remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través del título del álbum."
    }
  ],
  "lastModified": "2026-06-17T00:35:49.017",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:synology:audio_station:5.1-2541:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3BED8D3F-A8E6-4BAC-B1EE-F537F8B717CC"
            },
            {
              "criteria": "cpe:2.3:a:synology:audio_station:5.1-2542:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1726F9C-CF4D-42A0-BA3C-AF9A92959237"
            },
            {
              "criteria": "cpe:2.3:a:synology:audio_station:5.1-2547:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "048B9D89-FDF6-47D8-8BE8-33A4667BFDE4"
            },
            {
              "criteria": "cpe:2.3:a:synology:audio_station:5.1-2549:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40ADF949-277F-4C23-AAAE-1A6E7CB23027"
            },
            {
              "criteria": "cpe:2.3:a:synology:audio_station:5.4-2852:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD27E944-577A-4C06-AC3F-8D54C2263BDD"
            },
            {
              "criteria": "cpe:2.3:a:synology:audio_station:5.4-2853:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "158ADD2F-5EF0-443F-8BB6-D6C113E0CFCD"
            },
            {
              "criteria": "cpe:2.3:a:synology:audio_station:5.4-2855:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE0BF7DC-0A44-471C-A39F-CE694AF20389"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@synology.com"
}