Synology SSO Server vulnerabilities

2 CVEs affecting Synology SSO Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-27620, published 2022-08-03.

More from Synology.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-27620, published 2022-08-03. Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read…
• CVE-2017-16775, published 2019-04-01. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct clickjacking attacks via unspecified…