First published: Fri Sep 11 2015(Updated: )
Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Synology Download Station | <=3.5-2956 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2015-6909 is classified as a medium severity vulnerability due to the potential for remote exploitation.
To fix CVE-2015-6909, you should update Synology Download Station to version 3.5-2962 or later.
CVE-2015-6909 affects all versions of Synology Download Station prior to 3.5-2962.
CVE-2015-6909 is a cross-site scripting (XSS) vulnerability.
An attacker can inject arbitrary web script or HTML into the application through the name element in a torrent file.