CVE-2020-27650

State: Published
Severity: 5.8 Medium
Published: Oct 29, 2020
Updated: Sep 16, 2024
Reserved: Oct 22, 2020

Description

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L	synology

Weaknesses

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Affected Products

Product	Versions
DiskStation Manager (DSM)Synology	before 6.2.3-25426-2Affected

References

https://www.synology.com/security/advisory/Synology_SA_20_18

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.