CVE-2024-0854

Summary

URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7 and 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors.

Affected Software

VendorProductVersion RangeStatus
SynologyDiskStation Manager (DSM)7.2 < 7.2.1-69057-2affected
SynologyDiskStation Manager (DSM)7.1 < 7.1.1-42962-7affected
SynologyDiskStation Manager (DSM)7.0 < 7.0.1-42218-7affected
SynologyDiskStation Manager (DSM)6.2 < 6.2.4-25556-8affected
SynologyDiskStation Manager (DSM)0 < 6.2unknown

Weaknesses

  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References