CVE-2024-29237

Description

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Reserved 2024-03-19 | Published 2024-03-28 | Updated 2024-08-02 | Assigner synology

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
affected

* before 9.2.0-11289
affected

* before 9.2.0-9289
affected

Credits

TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us) finder

References

www.synology.com/...obal/security/advisory/Synology_SA_24_04 (Synology-SA-24:04 Surveillance Station) vendor-advisory

cve.org (CVE-2024-29237)

nvd.nist.gov (CVE-2024-29237)

Download JSON