CVE-2019-11829
Quick assessment
Affected
Synology Calendar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Synology Calendar是中国台湾群晖科技（Synology）公司的一款运行在Synology NAS（网络存储服务器）设备上的文件保护程序。 Synology Calendar 2.3.1-0617之前版本中的drivers_syno_import_user.php文件存在操作系统命令注入漏洞。该漏洞源于外部输入数据构造操作系统可执行命令过程中，网络系统或产品未正确过滤其中的特殊字符、命令等。攻击者可利用该漏洞执行非法操作系统命令。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-11829
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Synology Calendar 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Synology Calendar是中国台湾群晖科技（Synology）公司的一款运行在Synology NAS（网络存储服务器）设备上的文件保护程序。 Synology Calendar 2.3.1-0617之前版本中的drivers_syno_import_user.php文件存在操作系统命令注入漏洞。该漏洞源于外部输入数据构造操作系统可执行命令过程中，网络系统或产品未正确过滤其中的特殊字符、命令等。攻击者可利用该漏洞执行非法操作系统命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2019-11829
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-11829
请登录查看更多情报信息。
Other References for CVE-2019-11829 (1)
-
https://www.synology.com/security/advisory/Synology_SA_19_12 x_refsource_CONFIRM
Same Patch Batch · Synology · 2019-06-30 · 7 CVEs total
| CVE-2019-11826 | 8.0 HIGH | Synology Moments 路径遍历漏洞 |
| CVE-2019-11821 | 7.3 HIGH | Synology Photo Station SQL注入漏洞 |
| CVE-2019-11827 | 6.5 MEDIUM | Synology Note Station 跨站脚本漏洞 |
| CVE-2019-11825 | 6.5 MEDIUM | Synology Calendar 跨站脚本漏洞 |
| CVE-2019-11828 | 5.5 MEDIUM | Synology Office 跨站脚本漏洞 |
| CVE-2019-11822 | 4.3 MEDIUM | Synology Photo Station 路径遍历漏洞 |
IV. Related Vulnerabilities
Same product: Calendar
-
CVE-2026-14827
Calendar < 1.3.18 - Contributor+ Stored XSS via event_link P -
CVE-2026-29052
HumHub Calendar Module: Stored XSS in Event Types -
CVE-2025-14548
Calendar <= 1.3.16 - Authenticated (Contributor+) Stored Cro -
CVE-2024-2831
Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Inject -
CVE-2023-30678
SAMSUNG Calendar 路径遍历漏洞
Same weakness: CWE-78
-
CVE-2026-57998
better-npm-audit OS Command Injection via registry flag -
CVE-2026-41451
UAC < 3.3.0 Command Injection via User Substitution in parse -
CVE-2026-41450
UAC < 3.3.0 Command Injection via command_collector.sh -
CVE-2026-41449
UAC < 3.3.0 Command Injection via run_command.sh -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m
V. Comments for CVE-2019-11829
No comments yet