CVE-2010-2453: XSS

Published Sep 29, 2010

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before DSM3.0-1337 allow remote attackers to inject arbitrary web script or HTML by connecting to the FTP server and providing a crafted (1) USER or (2) PASS command, which is written by the FTP logging module to a web-interface log window, related to a "web commands injection" issue.

Affected Software

22 affected components

Synology DSM=2.2-0942

Synology DSM=2.2-1041

Synology DSM=2.2-1042

Synology DSM=2.2-1045

Synology DSM=2.3-1139

Synology DSM=2.3-1141

Synology DSM=2.3-1144

Synology DSM=2.3-1157

Synology DSM=2.3-1161

Synology DSM=3.0-1334

Synology Disk Station Ds1010\+

Synology Disk Station Ds109

Synology Disk Station Ds110\+

Synology Disk Station Ds110j

Synology Disk Station Ds209

Synology Disk Station Ds210\+

Synology Disk Station Ds210j

Synology Disk Station Ds409slim

Synology Disk Station Ds410

Synology Disk Station Ds410j

Synology Disk Station Ds411\+

Synology Disk Station Ds710\+

Event History

Sep 29, 2010

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

05:00 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-2453?

CVE-2010-2453 has a medium severity rating, primarily due to the ability for remote attackers to execute arbitrary web scripts.

How do I fix CVE-2010-2453?

To mitigate CVE-2010-2453, upgrade to DSM version 3.0-1337 or later to patch the XSS vulnerabilities.

What are the affected versions for CVE-2010-2453?

CVE-2010-2453 affects Synology Disk Station Manager versions 2.x before DSM3.0-1337.

How can CVE-2010-2453 be exploited?

CVE-2010-2453 can be exploited by sending crafted USER or PASS commands to the FTP server to inject arbitrary web scripts.

What are the potential impacts of CVE-2010-2453?

The potential impacts of CVE-2010-2453 include unauthorized access to user sessions or web content through XSS attacks.