CVE-2024-4464

Published: Dec 18, 2024Modified: Jan 29, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security@synology.com (Secondary)

Description

Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors.

Affected (3)

Products: Synology: Media Server

Synology

1 product

Media Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Synology Media Server	Before 1.4-2680
Synology Media Server	From 2.0.0-11050 to 2.0.5-3152
Synology Media Server	From 2.2.0-3324 to 2.2.0-3325

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

https://www.synology.com/en-global/security/advisory/Synology_SA_24_28

Source: security@synology.com

Vendor Advisory

Timeline

No history available yet.