« Volver al listado

CVE-2017-12071

Estado: ModificadaMedia (6.5)—

Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Synology — Photo Station

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-12071",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@synology.com",
      "affectedData": [
        {
          "vendor": "Synology",
          "product": "Synology Photo Station",
          "versions": [
            {
              "status": "affected",
              "version": "before 6.7.4-3433 and 6.3-2968"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-08T14:29:00.290",
  "references": [
    {
      "url": "https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@synology.com"
    },
    {
      "url": "https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@synology.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad Server-Side Request Forgery (SSRF) en file_upload.php en Synology Photo Station en versiones anteriores a la 6.7.4-3433 y 6.3-2968 permite que usuarios remotos autenticados descarguen archivos locales arbitrarios mediante el parámetro url."
    }
  ],
  "lastModified": "2026-06-17T01:02:38.047",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23EC868E-F493-4A58-B3D5-0D05F33725FD",
              "versionEndIncluding": "6.3-2967"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EDAA6AE-EA8A-4B2E-A36D-9EBC48BFC485",
              "versionEndIncluding": "6.7.3-3432"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@synology.com"
}