CVE-2019-11829

CRITICAL 9.8CVE-2019-11829 · Published 30/06/2019 · updated 17/06/2026

In short

CVE-2019-11829 is a CRITICAL (CVSS 9.8) vulnerability affecting calendar (synology).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.9% of all vulnerabilities.
Fix: update to 2.3.1-0617 or later.

Package	Affected versions	Patched versions
calendar synology	`< 2.3.1-0617`	`2.3.1-0617`

Description

OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header.

References

synology.com/security/advisory/Synology_SA_19_12 · Vendor Advisory

More vulnerabilities in calendar

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

calendar

synology

< 2.3.1-0617

2.3.1-0617

More vulnerabilities in calendar

See all →