TI-2017-12335 Aliases CVE-2017-16775 GHSA-q54f-p9w8-3gc2

Clickjacking in Synology SSO Server

LOW 33CWE-1021Published 2019-04-01 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-1021.

Summary

Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

Why it matters now

EPSS 0.01075 65th percentileScored 2026-11-07

Fix Fixed SSO Server (Synology): 2.1.3-0129

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Synology	SSO Server	before 2.1.3-0129	2.1.3-0129	Patch available	CNA

SSO Server VendorSynology Affected before 2.1.3-0129 Fixed in 2.1.3-0129 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:synology:sso_server::::::::	before 2.1.3-0129	Vulnerable	Synology

cpe:2.3:a:synology:sso_server:*:*:*:*:*:*:*:* Versions before 2.1.3-0129 Vulnerable ·Synology

Remediation

Fix · CNA SSO Server (Synology) Fixed in 2.1.3-0129

Timeline

2026-10-02 Threatist record created from CVE-2017-16775
2026-10-03 Alias added: GHSA-q54f-p9w8-3gc2

References

Advisory 1

https://www.synology.com/security/advisory/Synology_SA_18_28

TI-2022-10601 Path traversal in Synology SSO Server CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences