Vulnerability CVE-2010-3684

Vulnerability CVE-2010-3684

Published: 2010-09-29 Modified: 2012-02-13

Description:

The FTP authentication module in Synology Disk Station 2.x logs passwords to the web application interface in cases of incorrect login attempts, which allows local users to obtain sensitive information by reading a log, a different vulnerability than CVE-2010-2453.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Synology Disk Station Web commands injection	Rodrigo Branco	02.10.2010

Type:

CWE-255

(Credentials Management)

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
2.1/10	2.9/10	3.9/10

Exploit range	Attack complexity	Authentication
Local	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	None	None

Affected software
Synology -> DSM

References:

http://www.securityfocus.com/archive/1/513970/100/0/threaded

Copyright 2024, cxsecurity.com