CVE-2024-10443: Synology BeePhotos, инжекция

Описание

Оригинално описание

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.

Засегнати продукти

• Synology BeePhotos: * преди 1.1.0-10053; * преди 1.0.2-10026
• Synology Synology Photos: * преди 1.7.0-0795; * преди 1.6.2-0720
• synology photo_station: преди 1.6.2-0720

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-10443
• https://nvd.nist.gov/vuln/detail/CVE-2024-10443
• https://www.synology.com/en-global/security/advisory/Synology_SA_24_18
• https://www.synology.com/en-global/security/advisory/Synology_SA_24_19