Synology Chat Server
Monthly
Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application.
Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application.
Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.