CVE-2018-13297 Information disclosure in Drive

What is CVE-2018-13297?

CVE-2018-13297 is a medium-severity vulnerability in Synology Drive, published on 1 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsm_path parameter.

Weakness: CWE-200

Which versions are affected by CVE-2018-13297?

It affects 1 product.

Products include Synology Drive Server.

How do I fix CVE-2018-13297?

No fix has been published for CVE-2018-13297 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-13297 being exploited?

There is no known exploitation of CVE-2018-13297 in the wild and no public exploit code.

Other vulnerabilities in Synology Drive

• CVE-2024-50630 Missing authorization in Synology Drive Server High 7.5
• CVE-2024-50631 SQL injection in Synology Drive Server High 7.5
• CVE-2018-8921 Cross-site scripting in Drive Medium 6.5
• CVE-2018-8922 Missing authorization in Drive Medium 6.5
• CVE-2018-8910 Cross-site scripting in Drive Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-78vv-7rrg-22r5.