CVE-2015-9102 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00327.

Key SSVC decision points have not yet been added.

Vendors	Products
Synology	Photo Station

Configuration 1 [-]

cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2015-8955	Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.fortiguard.com/zeroday/FG-VD-15-103
http://www.fortiguard.com/zeroday/FG-VD-15-104
http://www.fortiguard.com/zeroday/FG-VD-15-109
http://www.fortiguard.com/zeroday/FG-VD-15-112
https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962

History

No history.

MITRE

Status: PUBLISHED

Assigner: synology

Published: 2017-06-30T13:00:00Z

Updated: 2024-09-17T03:14:38.172Z

Reserved: 2017-06-29T00:00:00

Link: CVE-2015-9102

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-06-30T13:29:00.177

Modified: 2025-04-20T01:37:25.860

Link: CVE-2015-9102

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Photo Station", "vendor": "Synology", "versions": [{"status": "affected", "version": "6.0"}, {"status": "affected", "version": "6.3"}]}], "datePublic": "2015-12-13T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Cross Site Scripting (CWE-79)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T12:57:01", "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-104"}, {"tags": ["x_refsource_MISC"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-109"}, {"tags": ["x_refsource_MISC"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-112"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962"}, {"tags": ["x_refsource_MISC"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-103"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@synology.com", "DATE_PUBLIC": "2015-12-13T00:00:00", "ID": "CVE-2015-9102", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Photo Station", "version": {"version_data": [{"version_value": "6.0"}, {"version_value": "6.3"}]}}]}, "vendor_name": "Synology"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross Site Scripting (CWE-79)"}]}]}, "references": {"reference_data": [{"name": "http://www.fortiguard.com/zeroday/FG-VD-15-104", "refsource": "MISC", "url": "http://www.fortiguard.com/zeroday/FG-VD-15-104"}, {"name": "http://www.fortiguard.com/zeroday/FG-VD-15-109", "refsource": "MISC", "url": "http://www.fortiguard.com/zeroday/FG-VD-15-109"}, {"name": "http://www.fortiguard.com/zeroday/FG-VD-15-112", "refsource": "MISC", "url": "http://www.fortiguard.com/zeroday/FG-VD-15-112"}, {"name": "https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962", "refsource": "CONFIRM", "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962"}, {"name": "http://www.fortiguard.com/zeroday/FG-VD-15-103", "refsource": "MISC", "url": "http://www.fortiguard.com/zeroday/FG-VD-15-103"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T08:36:31.961Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-104"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-109"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-112"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-103"}]}]}, "cveMetadata": {"assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "assignerShortName": "synology", "cveId": "CVE-2015-9102", "datePublished": "2017-06-30T13:00:00Z", "dateReserved": "2017-06-29T00:00:00", "dateUpdated": "2024-09-17T03:14:38.172Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D392B8A-1DCF-4B74-921B-4A2A55F794DE", "versionEndIncluding": "6.3-2960", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos."}, {"lang": "es", "value": "Varias vulnerabilidades de XSS (cross-site scripting) en Synology Photo Station versi\u00f3n 6.0 y anteriores a la 6.0-2638, versi\u00f3n 6.3 y anteriores a la 6.3-2962, permiten a atacantes remotos autenticados inyectar secuencias de comandos web o HTML a trav\u00e9s del (1) nombre del \u00e1lbum (2) nombre de las im\u00e1genes subidas, (3) descripci\u00f3n de fotos, o (4) etiqueta de las fotos."}], "id": "CVE-2015-9102", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-30T13:29:00.177", "references": [{"source": "security@synology.com", "tags": ["Third Party Advisory"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-103"}, {"source": "security@synology.com", "tags": ["Third Party Advisory"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-104"}, {"source": "security@synology.com", "tags": ["Third Party Advisory"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-109"}, {"source": "security@synology.com", "tags": ["Third Party Advisory"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-112"}, {"source": "security@synology.com", "tags": ["Vendor Advisory"], "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-103"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-104"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-109"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.fortiguard.com/zeroday/FG-VD-15-112"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962"}], "sourceIdentifier": "security@synology.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@synology.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}