{"id":"CVE-2020-27650","state":"PUBLISHED","title":"Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to captu","description":"Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.","publishedAt":"2020-10-29T09:00:25.555Z","updatedAt":"2024-09-16T23:10:20.265Z","severity":{"score":5.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"synology"},"assigner":"synology","products":["Synology DiskStation Manager (DSM)"],"affected":[{"vendor":"Synology","product":"DiskStation Manager (DSM)","versions":[{"version":"unspecified","status":"affected","lessThan":"6.2.3-25426-2","versionType":"custom"}]}],"references":["https://www.synology.com/security/advisory/Synology_SA_20_18"],"weaknesses":["CWE-614"],"ingestedAt":"2026-10-29T19:47:11.046Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/27xxx/CVE-2020-27650.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-27650","state":"PUBLISHED","datePublished":"2020-10-29T09:00:25.555Z","dateUpdated":"2024-09-16T23:10:20.265Z","assignerShortName":"synology","assignerOrgId":"db201096-a0cc-46c7-9a55-61d9e221bf01","dateReserved":"2020-10-22T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session."}],"affected":[{"vendor":"Synology","product":"DiskStation Manager (DSM)","versions":[{"version":"unspecified","status":"affected","lessThan":"6.2.3-25426-2","versionType":"custom"}]}],"references":[{"url":"https://www.synology.com/security/advisory/Synology_SA_20_18","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-614","description":"CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"synology","dateUpdated":"2020-10-29T09:00:25.000Z","orgId":"db201096-a0cc-46c7-9a55-61d9e221bf01"},"datePublic":"2020-10-29T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@synology.com","DATE_PUBLIC":"2020-10-29T00:00:00","ID":"CVE-2020-27650","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"DiskStation Manager (DSM)","version":{"version_data":[{"affected":"<","version_affected":"<","version_value":"6.2.3-25426-2"}]}}]},"vendor_name":"Synology"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session."}]},"impact":{"cvss":{"baseScore":"5.8","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"}]}]},"references":{"reference_data":[{"name":"https://www.synology.com/security/advisory/Synology_SA_20_18","refsource":"CONFIRM","url":"https://www.synology.com/security/advisory/Synology_SA_20_18"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.synology.com/security/advisory/Synology_SA_20_18","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T16:18:45.458Z"}}]}}}