TI-2018-06451 Aliases CVE-2018-8913 GHSA-3cwx-q62p-7m5h

Open redirect in Synology Web Station

LOW 33CWE-756Published 2019-04-01 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL.

Why it matters now

EPSS 0.01119 66th percentileScored 2026-11-07

Fix Fixed Web Station (Synology): 2.1.3-0139

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Synology	Web Station	before 2.1.3-0139	2.1.3-0139	Patch available	CNA

Web Station VendorSynology Affected before 2.1.3-0139 Fixed in 2.1.3-0139 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:synology:web_station::::::::	before 2.1.3-0139	Vulnerable	Synology

cpe:2.3:a:synology:web_station:*:*:*:*:*:*:*:* Versions before 2.1.3-0139 Vulnerable ·Synology

Remediation

Fix · CNA Web Station (Synology) Fixed in 2.1.3-0139

Timeline

2026-10-02 Threatist record created from CVE-2018-8913
2026-10-03 Alias added: GHSA-3cwx-q62p-7m5h

References

Advisory 1

https://www.synology.com/security/advisory/Synology_SA_18_29

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences