CVE-2017-12080 Information disclosure in Photo Station

What is CVE-2017-12080?

CVE-2017-12080 is a medium-severity vulnerability in Synology Photo Station, published on 4 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain sensitive system information via .htaccess file.

Weakness: CWE-200

Which versions are affected by CVE-2017-12080?

It affects 1 product.

Products include Synology Photo Station.

How do I fix CVE-2017-12080?

No fix has been published for CVE-2017-12080 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-12080 being exploited?

There is no known exploitation of CVE-2017-12080 in the wild and no public exploit code.

Other vulnerabilities in Synology Photo Station

• CVE-2021-29089 SQL injection in Synology Photo Station Critical 9.8
• CVE-2017-11161 SQL injection in Synology Photo Station Critical 9.8
• CVE-2017-11151 File upload in Synology Photo Station Critical 9.8
• CVE-2017-11153 Deserialization in Synology Photo Station Critical 9.8
• CVE-2016-10329 Command injection in Synology Photo Station Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cqcj-crrg-47xp.