CVE-2017-9554: Infoleak
Published Jul 24, 2017
·Updated
An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.
Affected Software
2 affected components
Synology Diskstation Manager<=6.1.1-15101-4
Synology Diskstation Manager<=6.1.1-15101-4
Event History
Jul 24, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-9554?
CVE-2017-9554 has been identified as a moderate severity information exposure vulnerability.
2
How do I fix CVE-2017-9554?
To mitigate CVE-2017-9554, users should upgrade to Synology DiskStation Manager version 6.1.3-15152 or later.
3
What type of attack is made possible by CVE-2017-9554?
CVE-2017-9554 allows remote attackers to enumerate valid usernames on affected Synology DiskStation Managers.
4
Which versions of Synology DiskStation Manager are affected by CVE-2017-9554?
CVE-2017-9554 affects Synology DiskStation Manager versions up to and including 6.1.1-15101-4.
5
Is my data at risk due to CVE-2017-9554?
Yes, CVE-2017-9554 poses a risk as it enables attackers to discover valid usernames, potentially leading to further exploitation.