Intrusion Prevention

Synology.DSM.Photo.Station.XSS

Description

This indicates an attack attempt against multiple Cross-Site Scripting (XSS) vulnerabilities in Synology DiskStation Manager (DSM) Photo Station.
The vulnerability is due to an error in the application when handling malformed inputs. An attacker can exploit this to execute arbitrary script code within context of the target users browser.

Affected Products

Photo Station version 6.3-2960
Other versions may be affected too

Impact

System Compromise: Remote attackers can execute arbitrary script code within the context of the target users browser

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://www.synology.com/en-us/dsm

CVE References

CVE-2015-9102