PT-2024-22832
CVE-2024-29236
·
تاريخ النشر
2024-03-27
·
تاريخ التحديث
2025-01-14
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Synology Surveillance Station versions prior to 9.2.0-9289
Synology Surveillance Station versions prior to 9.2.0-11289
Description
The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'SQL Injection', in the AudioPattern.Delete webapi component. This allows remote authenticated users to inject SQL commands via unspecified vectors.
Recommendations
For versions prior to 9.2.0-9289, update to version 9.2.0-9289 or later.
For versions prior to 9.2.0-11289, update to version 9.2.0-11289 or later.
As a temporary workaround, consider restricting access to the AudioPattern.Delete webapi component until a patch is applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾