critical10.0Public exploit code
CVE-2013-6955
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attacke…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Synology DiskStation Manager - SLICEUPLOAD Remote Command Execution (Metasploit)2013-12-24 · remote · unix · Verified
Impact
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Synology | Diskstation Manager | Versions 4.0, 4.2, 4.3, 4.3-3810 |