CVE-2020-27658

State: Published
Severity: 7.1 High
Published: Oct 29, 2020
Updated: Sep 17, 2024
Reserved: Oct 22, 2020

Description

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	synology

Weaknesses

CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag

Affected Products

Product	Versions
Synology Router Manager (SRM)Synology	before 1.2.4-8081Affected

References

https://www.synology.com/security/advisory/Synology_SA_20_14
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1086

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.