Details of VAR-202208-0251

ID

VAR-202208-0251

CVE

CVE-2022-27619

TITLE

Synology Inc. of Note Station Vulnerability in plaintext transmission of important information in

Trust: 0.8

sources: JVNDB: JVNDB-2022-014124

DESCRIPTION

Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors. Synology Inc

Trust: 1.8

sources: NVD: CVE-2022-27619 // JVNDB: JVNDB-2022-014124 // VULHUB: VHN-418272 // VULMON: CVE-2022-27619

AFFECTED PRODUCTS

vendor:	synology	model:	note station	scope:	lt	version:	2.2.2-609	Trust: 1.0
vendor:	synology	model:	note station	scope:	eq	version:	-	Trust: 0.8
vendor:	synology	model:	note station	scope:	-	version:	-	Trust: 0.8
vendor:	synology	model:	note station	scope:	eq	version:	2.2.2-609	Trust: 0.8

sources: JVNDB: JVNDB-2022-014124 // NVD: CVE-2022-27619

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-27619
value:	MEDIUM
Trust: 1.8
security@synology.com:	CVE-2022-27619
value:	MEDIUM
Trust: 1.0
CNNVD:	CNNVD-202208-2049
value:	MEDIUM
Trust: 0.6

NVD:
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	3.6
version:	3.1
Trust: 1.0
security@synology.com:
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	4.0
version:	3.1
Trust: 1.0
NVD:	CVE-2022-27619
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-014124 // NVD: CVE-2022-27619 // NVD: CVE-2022-27619 // CNNVD: CNNVD-202208-2049

PROBLEMTYPE DATA

problemtype:	CWE-319	Trust: 1.1
problemtype:	Sending important information in clear text (CWE-319) [ others ]	Trust: 0.8

sources: VULHUB: VHN-418272 // JVNDB: JVNDB-2022-014124 // NVD: CVE-2022-27619

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202208-2049

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202208-2049

CONFIGURATIONS

sources: NVD: CVE-2022-27619

PATCH

title:

Synology Note Station Security vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=203488

Trust: 0.6

sources: CNNVD: CNNVD-202208-2049

EXTERNAL IDS

db:	NVD	id:	CVE-2022-27619	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-014124	Trust: 0.8
db:	CNNVD	id:	CNNVD-202208-2049	Trust: 0.6
db:	VULHUB	id:	VHN-418272	Trust: 0.1
db:	VULMON	id:	CVE-2022-27619	Trust: 0.1

sources: VULHUB: VHN-418272 // VULMON: CVE-2022-27619 // JVNDB: JVNDB-2022-014124 // NVD: CVE-2022-27619 // CNNVD: CNNVD-202208-2049

REFERENCES

url:	https://www.synology.com/security/advisory/synology_sa_22_12	Trust: 2.6
url:	https://nvd.nist.gov/vuln/detail/cve-2022-27619	Trust: 0.8
url:	https://vigilance.fr/vulnerability/synology-dsm-man-in-the-middle-via-note-station-client-38978	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-27619/	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/319.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-418272 // VULMON: CVE-2022-27619 // JVNDB: JVNDB-2022-014124 // NVD: CVE-2022-27619 // CNNVD: CNNVD-202208-2049

SOURCES

db:	VULHUB	id:	VHN-418272
db:	VULMON	id:	CVE-2022-27619
db:	JVNDB	id:	JVNDB-2022-014124
db:	NVD	id:	CVE-2022-27619
db:	CNNVD	id:	CNNVD-202208-2049

LAST UPDATE DATE

2023-12-18T11:55:46.277000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-418272	date:	2022-08-09T00:00:00
db:	VULMON	id:	CVE-2022-27619	date:	2022-08-03T00:00:00
db:	JVNDB	id:	JVNDB-2022-014124	date:	2023-09-14T08:12:00
db:	NVD	id:	CVE-2022-27619	date:	2022-08-09T13:14:03.220
db:	CNNVD	id:	CNNVD-202208-2049	date:	2022-08-10T00:00:00

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-418272	date:	2022-08-03T00:00:00
db:	VULMON	id:	CVE-2022-27619	date:	2022-08-03T00:00:00
db:	JVNDB	id:	JVNDB-2022-014124	date:	2023-09-14T00:00:00
db:	NVD	id:	CVE-2022-27619	date:	2022-08-03T03:15:08.227
db:	CNNVD	id:	CNNVD-202208-2049	date:	2022-08-03T00:00:00