CVE-2024-45539

A Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.

SQL injection vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain arbitrary shared files.

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks.

A vulnerability in the Auto block feature in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks. The issue stems from improper restriction of excessive authentication attempts.

Server-Side Request Forgery (SSRF) vulnerability in the PersonMail API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain non-sensitive information.

Path traversal vulnerability in the Audio API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain non-sensitive information.

Path traversal vulnerability in the Desktop API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote attacker can write limited files and conduct limited denial-of-service attacks.

Cross-site scripting (XSS) vulnerability in the Video API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can read or write limited files when the player is launched.

Exposure of sensitive information through data queries vulnerability in the Desktop API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote attacker can obtain non-sensitive information.