CVE-2017-16769 Information disclosure in Synology Photo Station

What is CVE-2017-16769?

CVE-2017-16769 is a medium-severity vulnerability in Synology Photo Station, published on 23 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs via the map viewer mode.

Weakness: CWE-200, CWE-359

Which versions are affected by CVE-2017-16769?

It affects 1 product.

Products include Synology Photo Station.

How do I fix CVE-2017-16769?

No fix has been published for CVE-2017-16769 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-16769 being exploited?

There is no known exploitation of CVE-2017-16769 in the wild and no public exploit code.

Other vulnerabilities in Synology Photo Station

• CVE-2021-29089 SQL injection in Synology Photo Station Critical 9.8
• CVE-2017-11161 SQL injection in Synology Photo Station Critical 9.8
• CVE-2017-11151 File upload in Synology Photo Station Critical 9.8
• CVE-2017-11153 Deserialization in Synology Photo Station Critical 9.8
• CVE-2016-10329 Command injection in Synology Photo Station Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q6xf-6x38-cpf6.