CVE-2017-11149

Published: Aug 14, 2017Modified: May 13, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.

Affected (33)

Products: Synology: Download Station

Synology

1 product

Download Station

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Synology Download Station	Version 3.2-2295
Synology Download Station	Version 3.3-2382
Synology Download Station	Version 3.3-2383
Synology Download Station	Version 3.3-2386
Synology Download Station	Version 3.4-2477
Synology Download Station	Version 3.4-2478
Synology Download Station	Version 3.4-2480
Synology Download Station	Version 3.4-2485
Synology Download Station	Version 3.4-2486
Synology Download Station	Version 3.4-2489
Synology Download Station	Version 3.4-2490
Synology Download Station	Version 3.4-2514
Synology Download Station	Version 3.4-2555
Synology Download Station	Version 3.4-2557
Synology Download Station	Version 3.4-2558
Synology Download Station	Version 3.5-2638
Synology Download Station	Version 3.5-2705
Synology Download Station	Version 3.5-2706
Synology Download Station	Version 3.5-2955
Synology Download Station	Version 3.5-2956
Synology Download Station	Version 3.5-2962
Synology Download Station	Version 3.5-2963
Synology Download Station	Version 3.5-2967
Synology Download Station	Version 3.5-2968
Synology Download Station	Version 3.5-2970
Synology Download Station	Version 3.5-2973
Synology Download Station	Version 3.5-2980
Synology Download Station	Version 3.5-2982
Synology Download Station	Version 3.8.0-3416
Synology Download Station	Version 3.8.1-3420
Synology Download Station	Version 3.8.2-3455
Synology Download Station	Version 3.8.3-3458
Synology Download Station	Version 3.8.4-3468

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station

Source: security@synology.com

Vendor Advisory

https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.