CVE-2013-6987: Path Traversal

Published Dec 31, 2013

Updated

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the (1) path parameter to filedelete.cgi or (2) folderpath parameter to fileshare.cgi in webapi/FileStation/; (3) dlink parameter to fbdownload/; or unspecified parameters to (4) html5upload.cgi, (5) filedownload.cgi, (6) filesharing.cgi, (7) fileMVCP.cgi, or (8) filerename.cgi in webapi/FileStation/.

Affected Software

2 affected components

Synology Diskstation Manager=4.3-3810

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Synology DiskStation Manager (DSM) - FileStation/ FileBrowser to a version that resolves this vulnerability.
Fixed in 4.3-3810 Update 3

Event History

Dec 31, 2013

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·04:04 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-6987?

CVE-2013-6987 is classified as a critical vulnerability due to its potential for unauthorized file access and manipulation.

How do I fix CVE-2013-6987?

To mitigate CVE-2013-6987, upgrade Synology DiskStation Manager to version 4.3-3810 Update 3 or later.

What types of attacks can CVE-2013-6987 enable?

CVE-2013-6987 can allow remote attackers to read, write, and delete arbitrary files on the affected systems.

Which versions of Synology DiskStation Manager are affected by CVE-2013-6987?

CVE-2013-6987 affects Synology DiskStation Manager versions prior to 4.3-3810 Update 3.

What components of Synology DiskStation Manager are vulnerable in CVE-2013-6987?

CVE-2013-6987 impacts the FileBrowser components, particularly the file_delete.cgi and folder_path parameters.