CVE-2018-8927

Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter.

Score

CVSS 3.0 6.5 Medium

Status

Modified - security@synology.com

Published

2018-06-14

Last modified

2024-09-16

Weaknesses

CWE-863

Affected products

• Calendar (Synology)

References

• https://www.synology.com/en-global/support/security/Synology_SA_18_16