CVE-2010-2453

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2010-2453
Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before DSM3.0-1337 allow remote attackers to inject arbitrary web script or HTML by connecting to the FTP server and providing a crafted (1) USER or (2) PASS command, which is written by the FTP logging module to a web-interface log window, related to a "web commands injection" issue.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://www.securityfocus.com/archive/1/513970/100/0/threaded
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:synology:dsm:2.2-0942:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:2.2-1041:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:2.2-1042:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:2.2-1045:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:2.3-1139:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:2.3-1141:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:2.3-1144:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:2.3-1157:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:2.3-1161:*:*:*:*:*:*:*
cpe:2.3:o:synology:dsm:3.0-1334:*:*:*:*:*:*:*
OR cpe:2.3:h:synology:disk_station_ds1010\+:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds109:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds110\+:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds110j:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds209:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds210\+:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds210j:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds409slim:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds410:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds410j:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds411\+:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:disk_station_ds710\+:*:*:*:*:*:*:*:*
History

No history.

Information

Published : 2010-09-29 17:00

Updated : 2023-12-10 11:03

NVD link : CVE-2010-2453

Mitre link : CVE-2010-2453

CVE.ORG link : CVE-2010-2453

JSON object : View

Products Affected

synology

  • disk_station_ds210j
  • disk_station_ds410j
  • disk_station_ds110j
  • disk_station_ds1010\+
  • disk_station_ds710\+
  • disk_station_ds109
  • dsm
  • disk_station_ds409slim
  • disk_station_ds210\+
  • disk_station_ds411\+
  • disk_station_ds209
  • disk_station_ds110\+
  • disk_station_ds410
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')