Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a     compromised instance with shared folders could sync malicious files which contain arbitrary HTML and     JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the     mouse over the latest sync, a script could be executed to change settings for shared folders or add     devices automatically. Additionally adding a new device with a malicious name could embed HTML or     JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting     attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to     upgrade should avoid sharing folders with untrusted users. (CVE-2022-46165)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-bf86df7ee8 advisory.

    Update to version 1.23.5. Addresses CVE-2022-46165.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-39eb10ec3c advisory.

    Update to version 1.23.5. Addresses CVE-2022-46165.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
225028	Linux Distros Unpatched Vulnerability : CVE-2022-46165	Nessus	Misc.	medium
177362	Fedora 37 : syncthing (2023-bf86df7ee8)	Nessus	Fedora Local Security Checks	medium
177360	Fedora 38 : syncthing (2023-39eb10ec3c)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2022-46165

medium

Tenable Plugins

medium

medium

medium