CVE-2013-6987 - CVE House

Back to Database

Status published High CVE-2013-6987

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology...

7.5 CVSS

Vulnerability Description

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the (1) path parameter to file_delete.cgi or (2) folder_path parameter to file_share.cgi in webapi/FileStation/; (3) dlink parameter to fbdownload/; or unspecified parameters to (4) html5_upload.cgi, (5) file_download.cgi, (6) file_sharing.cgi, (7) file_MVCP.cgi, or (8) file_rename.cgi in webapi/FileStation/.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-6987

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from synology

View All →

An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager...

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM)...

Cross-site scripting (XSS) vulnerability in User Policy editor in Synology...

Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager...

Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM)...

Affected Vendor

synology

View all reports →

Affected Software

diskstation manager

Vulnerable Versions:

4.3-3810

Timeline

Official Publish: December 31st, 2013

Last Modified: August 6th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.