CVE-2020-27650

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Configurations

Configuration 1 (hide)

cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:synology:skynas_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:21

Type Values Removed Values Added
CVSS v2 : 4.3
v3 : 3.7
v2 : 4.3
v3 : 5.8
References () https://www.synology.com/security/advisory/Synology_SA_20_18 - Vendor Advisory () https://www.synology.com/security/advisory/Synology_SA_20_18 - Vendor Advisory

Information

Published : 2020-10-29 09:15

Updated : 2024-11-21 05:21


NVD link : CVE-2020-27650

Mitre link : CVE-2020-27650

CVE.ORG link : CVE-2020-27650


JSON object : View

Products Affected

synology

  • skynas
  • skynas_firmware
  • diskstation_manager
CWE
CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CWE-311

Missing Encryption of Sensitive Data