Lucene search

SynologyCVE-2020-27650

HistoryOct 29, 2020 - 9:15 a.m.

CVE-2020-27650

2020-10-2909:15:12

CWE-311

CWE-614

synology

web.nvd.nist.gov

synology

dsm

cve-2020-27650

security

session cookie

https

vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.3

Confidence

Low

EPSS

0.001

Percentile

48.6%

JSON

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Affected configurations

Nvd

Node

synologydiskstation_managerRange6.2–6.2.3-25426-2

Node

synologyskynasMatch-

AND

synologyskynas_firmwareRange<6.2.3-25426

VendorProductVersionCPE
synologydiskstation_manager*cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*
synologyskynas-cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:*
synologyskynas_firmware*cpe:2.3:o:synology:skynas_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
synology	diskstation_manager	*	cpe:2.3:a:synology:diskstation_manager::::::::
synology	skynas	-	cpe:2.3:h:synology:skynas:-:::::::*
synology	skynas_firmware	*	cpe:2.3:o:synology:skynas_firmware::::::::

CNA Affected

[
  {
    "product": "DiskStation Manager (DSM)",
    "vendor": "Synology",
    "versions": [
      {
        "lessThan": "6.2.3-25426-2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.synology.com/security/advisory/Synology_SA_20_18

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.3

Confidence

Low

EPSS

0.001

Percentile

48.6%

JSON

Related for CVE-2020-27650