Session Cookie Vulnerability in Synology Router Manager
CVE-2020-27651

5.8MEDIUM

Key Information:

Vendor
Synology
Status
Synology Router Manager (srm)
Vendor
CVE Published:
29 October 2020

Summary

A potential security flaw exists in Synology Router Manager (SRM) versions before 1.2.4-8081, where the Secure flag is not set for session cookies during HTTPS sessions. This oversight allows remote attackers to exploit the lack of protection, making it feasible to intercept session cookies during their transmission over non-secure HTTP connections. As a result, sensitive user data may be compromised, posing significant security risks.

Affected Version(s)

Synology Router Manager (SRM) < 1.2.4-8081

References

https://www.synology.com/security/advisory/Synology_SA_20_14
x_refsource_CONFIRM
https://www.talosintelligence.com/vulnerability_reports/T...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.