Sign-up

ID

VAR-202207-1999


CVE

CVE-2022-27613


TITLE

Synology Inc.  of  CardDAV Server  In  SQL  Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-013859

DESCRIPTION

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors. Synology Inc. of CardDAV Server for, SQL There is an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2022-27613 // JVNDB: JVNDB-2022-013859 // VULHUB: VHN-418266 // VULMON: CVE-2022-27613

AFFECTED PRODUCTS

vendor:synologymodel:carddav serverscope:ltversion:6.0.10-0153

Trust: 1.0

vendor:synologymodel:carddav serverscope:eqversion: -

Trust: 0.8

vendor:synologymodel:carddav serverscope:eqversion:6.0.10-0153

Trust: 0.8

vendor:synologymodel:carddav serverscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-013859 // NVD: CVE-2022-27613

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-27613
value: HIGH

Trust: 1.0

security@synology.com: CVE-2022-27613
value: HIGH

Trust: 1.0

NVD: CVE-2022-27613
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202207-2596
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2022-27613
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

security@synology.com: CVE-2022-27613
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 5.5
version: 3.1

Trust: 1.0

NVD: CVE-2022-27613
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-013859 // CNNVD: CNNVD-202207-2596 // NVD: CVE-2022-27613 // NVD: CVE-2022-27613

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.1

problemtype:SQL injection (CWE-89) [ others ]

Trust: 0.8

sources: VULHUB: VHN-418266 // JVNDB: JVNDB-2022-013859 // NVD: CVE-2022-27613

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-2596

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-202207-2596

PATCH

title:Synology CardDAV Server SQL Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=202472

Trust: 0.6

sources: CNNVD: CNNVD-202207-2596

EXTERNAL IDS

db:NVDid:CVE-2022-27613

Trust: 3.4

db:JVNDBid:JVNDB-2022-013859

Trust: 0.8

db:CNNVDid:CNNVD-202207-2596

Trust: 0.6

db:VULHUBid:VHN-418266

Trust: 0.1

db:VULMONid:CVE-2022-27613

Trust: 0.1

sources: VULHUB: VHN-418266 // VULMON: CVE-2022-27613 // JVNDB: JVNDB-2022-013859 // CNNVD: CNNVD-202207-2596 // NVD: CVE-2022-27613

REFERENCES

url:https://www.synology.com/security/advisory/synology_sa_21_06

Trust: 2.6

url:https://nvd.nist.gov/vuln/detail/cve-2022-27613

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-27613/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/89.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-418266 // VULMON: CVE-2022-27613 // JVNDB: JVNDB-2022-013859 // CNNVD: CNNVD-202207-2596 // NVD: CVE-2022-27613

SOURCES

db:VULHUBid:VHN-418266
db:VULMONid:CVE-2022-27613
db:JVNDBid:JVNDB-2022-013859
db:CNNVDid:CNNVD-202207-2596
db:NVDid:CVE-2022-27613

LAST UPDATE DATE

2024-08-14T14:24:38.802000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-418266date:2022-08-03T00:00:00
db:VULMONid:CVE-2022-27613date:2022-07-28T00:00:00
db:JVNDBid:JVNDB-2022-013859date:2023-09-12T08:20:00
db:CNNVDid:CNNVD-202207-2596date:2022-08-04T00:00:00
db:NVDid:CVE-2022-27613date:2022-08-03T20:16:53.043

SOURCES RELEASE DATE

db:VULHUBid:VHN-418266date:2022-07-28T00:00:00
db:VULMONid:CVE-2022-27613date:2022-07-28T00:00:00
db:JVNDBid:JVNDB-2022-013859date:2023-09-12T00:00:00
db:CNNVDid:CNNVD-202207-2596date:2022-07-28T00:00:00
db:NVDid:CVE-2022-27613date:2022-07-28T07:15:07.957