CVE-2022-27617

CVSS 3.1 Score 4.3 of 10 (medium)

Details

Published Aug 3, 2022
Updated: Jan 14, 2025
CWE ID 22

Summary

CVE-2022-27617 is a path traversal vulnerability affecting Synology Calendar's webapi component before version 2.3.4-0631. This issue allows remote authenticated users to access and download arbitrary files by manipulating input to bypass restrictions on file paths. The vulnerability is significant as it could potentially lead to the exposure of sensitive information or unauthorized system access. Synology urges users to upgrade to the latest version to mitigate this risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Synology Calendar

Affected Vendors

  • Synology

Advisories, Assessments, and Mitigations