Synology DiskStation Manager (DSM) before 6.2.3-25426-2... · CVE-2020-27650 · GitHub Advisory Database · GitHub

Synology DiskStation Manager (DSM) before 6.2.3-25426-2...

Moderate severity Unreviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Jan 14, 2025

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

References

Published by the National Vulnerability Database

Oct 29, 2020

Published to the GitHub Advisory Database May 24, 2022

Last updated Jan 14, 2025

Weaknesses

CWE-311

Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission. Learn more on MITRE.

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session. Learn more on MITRE.