Synology File Station vulnerabilities

3 CVEs affecting Synology File Station, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-13288, published 2019-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-15893, published 2017-12-08. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the dest_folder_path…
CVE-2018-13288, published 2019-04-01. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the (1)…
CVE-2018-8923, published 2018-06-05. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated users to inject arbitrary web script or HTML via malicious…