CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2017-04-10

Last modified

2024-09-16

Weaknesses

CWE-77

Affected products

• Photo Station (Synology)

References

• http://seclists.org/oss-sec/2016/q1/236
• https://www.synology.com/en-us/releaseNote/PhotoStation