CVE-2018-13283

Published: Apr 1, 2019Modified: Nov 21, 2024

7.4

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.2 / Impact: 5.2

Source: NVD

Description

Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command, (2) hostname, or (3) port parameter.

Affected (1)

Products: Synology: Ssl Vpn Client

Synology

1 product

Ssl Vpn Client

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Synology Ssl Vpn Client	Before 1.2.5-0226

Related CWEs

CWE-671

Lack of Administrator Control over Security

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

References (2)

https://www.synology.com/security/advisory/Synology_SA_18_30

Source: security@synology.com

Vendor Advisory

https://www.synology.com/security/advisory/Synology_SA_18_30

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.