description: An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option.
problem types: Improper Access Control (CWE-284)
affected:
{
product: DiskStation Manager (DSM)
vendor: Synology
versions:
status: affected, version: before 6.1.4-15217
status: affected, version: before 6.0.3-8754-6
}