CVE-2022-49037 Information disclosure in Synology Drive Client

Medium 6.5 Published 26 Sep 2024 Updated 26 Sep 2024

Remote authenticated users can obtain sensitive information from log files in Synology Drive Client, requiring an upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-49037?

CVE-2022-49037 is a medium-severity vulnerability in Synology Drive Client, published on 26 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allows remote authenticated users to obtain sensitive information via unspecified vectors.

Weakness: CWE-532

Which versions are affected by CVE-2022-49037?

It affects 1 product.

Products include Synology Drive Client.

How do I fix CVE-2022-49037?

No fix has been published for CVE-2022-49037 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-49037 being exploited?

There is no known exploitation of CVE-2022-49037 in the wild and no public exploit code.

Sources

Also known as GHSA-m9fj-gpr4-vjqm.