CVE-2018-13284: OS Command Injection
Published Apr 1, 2019
·Updated
Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.
Affected Software
8 affected components
Synology Diskstation Manager>=5.2<5.2-5967-8
Synology Diskstation Manager>=6.0<6.0.3-8754-8
Synology Diskstation Manager>=6.1<6.1.7-15284-1
Synology Diskstation Manager>=6.2<6.2-23739-1
Synology Diskstation Manager>=5.2<5.2-5967-8
Synology Diskstation Manager>=6.0<6.0.3-8754-8
Synology Diskstation Manager>=6.1<6.1.7-15284-1
Synology Diskstation Manager>=6.2<6.2-23739-1
Event History
Apr 1, 2019
CVE Published
via MITRE·02:26 PM
Data Sourced
via MITRE·02:26 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-13284?
CVE-2018-13284 is classified as a medium severity vulnerability due to the potential for remote command execution by authenticated users.
2
How do I fix CVE-2018-13284?
To mitigate CVE-2018-13284, upgrade your Synology DiskStation Manager to version 6.2-23739-1 or later.
3
Who is affected by CVE-2018-13284?
CVE-2018-13284 affects remote authenticated users of Synology DiskStation Manager versions prior to 6.2-23739-1.
4
What type of vulnerability is CVE-2018-13284?
CVE-2018-13284 is a command injection vulnerability that allows execution of arbitrary OS commands.
5
When was CVE-2018-13284 disclosed?
CVE-2018-13284 was disclosed in 2018 as part of Synology's security advisories.