High · 7.7 CVE-2024-29228 EUVD-2024-26242GHSA-vq86-gxf4-q6gh

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 al…

Published Mar 28, 2024 · Updated Aug 2, 2024 · Assigned by synology

Vendor: Synology Product: Surveillance Station

Description

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors.

Affected products

Vendor	Product	Affected	Fixed
Synology	Surveillance Station	< 9.2.0-9289, < 9.2.0-11289	9.2.0-9289

References

Synology-SA-24:04 Surveillance Station vendor-advisory