CVE-2021-43929
Assigner: synology
Published: 2022-01-19T00:00:00
State: PUBLISHED
affected: product: DiskStation Manager (DSM)
vendor: Synology
versions: lessThan: 7.0.1-42218-2
status: affected
version: unspecified
versionType: custom
datePublic: 2022-01-19T00:00:00
descriptions: value: Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-74
description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
type: CWE