CVE-2018-14695

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115

Description The issue concerns incorrect access control in the "/mysql/api/diags.php" endpoint, allowing unauthenticated attackers to retrieve diagnostic information. This is achieved via the name URL parameter.

Recommendations For Drobo 5N2 NAS version 4.0.5-13.28.96115, consider restricting access to the "/mysql/api/diags.php" endpoint until a patch is available. As a temporary workaround, avoid using the name parameter in this endpoint to minimize the risk of exploitation.