Julien Cayssol has reported some vulnerabilities in Syncrify, which can be exploited by malicious users and malicious people to bypass certain security restrictions.

1) The application does not properly restrict access to the password setup page, which can be exploited to change the administrator's password by accessing a certain page directly.

2) The application does not properly restrict access to the file browsing functionality, which can be exploited to browse a file by accessing a certain page directly.

3) The application does not properly restrict users from downloading files, which can be exploited to download files from the server by accessing a certain page directly.

Successful exploitation of this vulnerability requires valid user credentials.

The vulnerabilities are reported in version build 415 and prior.

Solution
Update to version Version 2.1 build 420.

Provided and/or discovered by
Julien Cayssol

Original Advisory
http://web.synametrics.com/SyncrifyVersionHistory.htm

Deep Links
Links available to Secunia VIM customers