CVE-2017-11149

MEDIUM 6.5CVE-2017-11149 · Published 14/08/2017 · updated 17/06/2026

In short

CVE-2017-11149 is a MEDIUM (CVSS 6.5) vulnerability affecting download station (synology).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
download station synology	`= 3.2-2295= 3.3-2382= 3.3-2383= 3.3-2386= 3.4-2477= 3.4-2478= 3.4-2480= 3.4-2485= 3.4-2486= 3.4-2489= 3.4-2490= 3.4-2514= 3.4-2555= 3.4-2557= 3.4-2558= 3.5-2638= 3.5-2705= 3.5-2706= 3.5-2955= 3.5-2956= 3.5-2962= 3.5-2963= 3.5-2967= 3.5-2968= 3.5-2970= 3.5-2973= 3.5-2980= 3.5-2982= 3.8.0-3416= 3.8.1-3420= 3.8.2-3455= 3.8.3-3458= 3.8.4-3468`	No fix yet

Description

Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.

References

synology.com/en-global/support/security/Synology_SA_17_28_Download_Station · Vendor Advisory

More vulnerabilities in download station

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

download station

synology

= 3.2-2295= 3.3-2382= 3.3-2383= 3.3-2386= 3.4-2477= 3.4-2478= 3.4-2480= 3.4-2485= 3.4-2486= 3.4-2489= 3.4-2490= 3.4-2514= 3.4-2555= 3.4-2557= 3.4-2558= 3.5-2638= 3.5-2705= 3.5-2706= 3.5-2955= 3.5-2956= 3.5-2962= 3.5-2963= 3.5-2967= 3.5-2968= 3.5-2970= 3.5-2973= 3.5-2980= 3.5-2982= 3.8.0-3416= 3.8.1-3420= 3.8.2-3455= 3.8.3-3458= 3.8.4-3468

No fix yet

More vulnerabilities in download station

See all →