CVE-2018-13281

MEDIUM

Synology DiskStation Manager < 6.2-23739-2 - Authenticated Information Exposure via SYNO.Core.ACL file_path Parameter

Title source: llm

Description

Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the file_path parameter.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://www.synology.com/en-global/support/security/Synology_SA_18_36

Scores

CVSS v3 4.3

EPSS 0.0013

EPSS Percentile 32.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (5)

synology/diskstation_manager 5.2

synology/diskstation_manager 6.0

synology/diskstation_manager 6.1 - 6.1.7-15284-2

synology/skynas

synology/vs960hd

Published Oct 31, 2018

Tracked Since Feb 18, 2026