Back to Database
Status published
Critical
CVE-2013-6955
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2...
Vulnerability Description
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-6955
Credits & Attribution
No credits recorded in the NVD database.
References
More from synology
View All →CVE-2017-9554
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager...
Medium
5.3
CVE-2017-9553
A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM)...
High
7.5
CVE-2017-16768
Cross-site scripting (XSS) vulnerability in User Policy editor in Synology...
Medium
4.8
CVE-2017-12077
Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager...
Medium
4.9
CVE-2017-12076
Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM)...
Medium
4.9
Affected Vendor
synology
View all reports →Affected Software
diskstation manager
Vulnerable Versions:
4.0, 4.2, 4.3, 4.3-3810
Timeline
Official Publish:
January 9th, 2014
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.