Vulnerability · Published Jun 1, 2021 · Assigned by synology
CVE-2021-33181
Medium 6.6
In plain English
A medium-severity server-side request forgery in Synology Video Station from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)1.0%top 37.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synology | Synology Video Station | unspecified – before 2.4.10-1632 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
References
- https://www.synology.com/security/advisory/Synology_SA_21_04 x_refsource_CONFIRM