6.5

CVE-2017-11149: synology download_station Server-Side Request Forgery (SSRF)

CVSS: 6.5v3.0MediumModified
Published 14-08-2017Last modified 16-09-2024
Open JSON

Vulnerability summary

CVE-2017-11149 is a medium (CVSS 6.5) Server-Side Request Forgery (SSRF) vulnerability in synology download_station. EPSS estimates a 1.60% chance of exploitation in the next 30 days, higher than 75.3% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.0 (NVD)
EPSS score
1.60%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 14-08-2017
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

Probability

1.60%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

0.00 pp

From 1.60% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Synology2 products
  • download_station3.2-2295 | 3.3-2382 | 3.3-2383 | 3.3-2386 | 3.4-2477 | 3.4-2478 | 3.4-2480 | 3.4-2485 | 3.4-2486 | 3.4-2489 | 3.4-2490 | 3.4-2514 | 3.4-2555 | 3.4-2557 | 3.4-2558 | 3.5-2638 | 3.5-2705 | 3.5-2706 | 3.5-2955 | 3.5-2956 | 3.5-2962 | 3.5-2963 | 3.5-2967 | 3.5-2968 | 3.5-2970 | 3.5-2973 | 3.5-2980 | 3.5-2982 | 3.8.0-3416 | 3.8.1-3420 | 3.8.2-3455 | 3.8.3-3458 | 3.8.4-3468
  • synology download station3.8.x before 3.8.5-3475 and 3.x before 3.5-2984

1 vendor · 2 products

References

1 links