Synology AB Agent <2.7.0-3221 Unencrypted Login Credentials Leak
CVE-2023-52950 Published on September 26, 2024

Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Missing Encryption of Sensitive Data

The software does not encrypt sensitive or critical information before storage or transmission. The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.


Products Associated with CVE-2023-52950

Want to know whenever a new CVE is published for Synology Active Backup Business Agent? stack.watch will email you.

Synology Active Backup Business Agent
 

Affected Versions

Synology Active Backup for Business Agent: synology active_backup_for_business_agent:

Exploit Probability

EPSS
0.06%
Percentile
17.29%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.