CVE-2020-27651

5.8MEDIUM

Key Information:

Vendor
Synology
Status
Synology Router Manager (srm)
Vendor
CVE Published:
29 October 2020

Summary

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Affected Version(s)

Synology Router Manager (SRM) < 1.2.4-8081

References

https://www.synology.com/security/advisory/Synology_SA_20_14
x_refsource_CONFIRM
https://www.talosintelligence.com/vulnerability_reports/T...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.