Medium · 6.5 CVE-2018-8910 EUVD-2018-20518GHSA-fgw3-g4rh-m5x5

Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to in…

Published May 10, 2018 · Updated Sep 16, 2024 · Assigned by synology

Description

Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments.

Affected products

Vendor	Product	Affected	Fixed
Synology	Drive	unspecified – < 1.0.1-10253	1.0.1-10253

References

https://www.synology.com/en-global/support/security/Synology_SA_18_05