CVE-2020-27650

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:synology:skynas_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-10-29 09:15

Updated : 2024-02-28 18:08


NVD link : CVE-2020-27650

Mitre link : CVE-2020-27650

CVE.ORG link : CVE-2020-27650


JSON object : View

Products Affected

synology

  • skynas
  • diskstation_manager
  • skynas_firmware
CWE
CWE-311

Missing Encryption of Sensitive Data

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute