« Volver al listado

CVE-2021-29087

Estado: ModificadaAlta (7.5)—

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to write arbitrary files via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Synology — Diskstation ManagerSynology — Diskstation Manager Unified Controller

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-29087",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@synology.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@synology.com",
      "affectedData": [
        {
          "vendor": "Synology",
          "product": "DiskStation Manager (DSM)",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "6.2.3-25426-3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-23T10:15:08.473",
  "references": [
    {
      "url": "https://www.synology.com/security/advisory/Synology_SA_20_26",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@synology.com"
    },
    {
      "url": "https://www.synology.com/security/advisory/Synology_SA_20_26",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@synology.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to write arbitrary files via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de limitación inapropiada de un nombre de ruta a un directorio restringido (\"'Path Traversal\") en el componente webapi de Synology DiskStation Manager (DSM) versiones anteriores a 6.2.3-25426-3, que permite a atacantes remotos escribir archivos arbitrarios por medio de vectores no especificados"
    }
  ],
  "lastModified": "2026-06-17T03:47:16.447",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "802D9C58-689C-496A-A9F2-A6A4879186B1",
              "versionEndExcluding": "6.2.3-25426-3",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:synology:diskstation_manager_unified_controller:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D88DE55-6990-40E9-9982-21070DB70608",
              "versionEndExcluding": "3.1-23033"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@synology.com"
}