« Volver al listado

CVE-2022-27618

Estado: ModificadaMedia (6.5)—

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390 allows remote authenticated users to delete arbitrary files via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Synology — Storage Analyzer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-27618",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@synology.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@synology.com",
      "affectedData": [
        {
          "vendor": "Synology",
          "product": "Storage Analyzer",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.1.0-0390",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-03T03:15:08.160",
  "references": [
    {
      "url": "https://www.synology.com/security/advisory/Synology_SA_22_11",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@synology.com"
    },
    {
      "url": "https://www.synology.com/security/advisory/Synology_SA_22_11",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@synology.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390 allows remote authenticated users to delete arbitrary files via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Una limitación inapropiada de un nombre de ruta a un directorio restringido (\"Salto de Ruta\") es una vulnerabilidad del componente webapi en Synology Storage Analyzer versiones anteriores a 2.1.0-0390, que permite a usuarios remotos autenticados eliminar archivos arbitrarios por vectores no especificados"
    }
  ],
  "lastModified": "2026-06-17T04:37:21.610",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:synology:storage_analyzer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FCB7180-B0BD-4636-89CC-F7B89699EAE8",
              "versionEndExcluding": "2.1.0-0390"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:synology:diskstation_manager:7.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "03C4D78F-52D3-442C-A7F7-F3CB334D343B"
            },
            {
              "criteria": "cpe:2.3:o:synology:diskstation_manager:7.1:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "10C4B055-D99B-4D58-811C-DD323A68A890"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:synology:storage_analyzer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8A346C3-912E-4EDC-9AE9-1503CD17D412",
              "versionEndExcluding": "2.0.1-0214"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D9685B12-824F-42AD-B87C-6E7A78BB7FA5"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@synology.com"
}