Lucene search

[email protected]NVD:CVE-2021-37189

HistoryDec 10, 2021 - 1:15 p.m.

CVE-2021-37189

2021-12-1013:15:07

CWE-311

[email protected]

web.nvd.nist.gov

cve-2021-37189

digi transport gateway

sensitive cookies

https sessions

user agent

cleartext

http session

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

55.6%

JSON

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

Affected configurations

Nvd

Node

digitransport_wr11_firmwareRange<6.0.0.0

AND

digitransport_wr11Match-

Node

digitransport_wr11_xt_firmwareRange<6.0.0.0

AND

digitransport_wr11_xtMatch-

Node

digitransport_wr21_firmwareRange<6.0.0.0

AND

digitransport_wr21Match-

Node

digitransport_wr31_firmwareRange<6.0.0.0

AND

digitransport_wr31Match-

Node

digitransport_wr41_firmwareRange<6.0.0.0

AND

digitransport_wr41Match-

Node

digitransport_wr44_firmwareRange<6.0.0.0

AND

digitransport_wr44Matchv2

VendorProductVersionCPE
digitransport_wr11_firmware*cpe:2.3:o:digi:transport_wr11_firmware:*:*:*:*:*:*:*:*
digitransport_wr11-cpe:2.3:h:digi:transport_wr11:-:*:*:*:*:*:*:*
digitransport_wr11_xt_firmware*cpe:2.3:o:digi:transport_wr11_xt_firmware:*:*:*:*:*:*:*:*
digitransport_wr11_xt-cpe:2.3:h:digi:transport_wr11_xt:-:*:*:*:*:*:*:*
digitransport_wr21_firmware*cpe:2.3:o:digi:transport_wr21_firmware:*:*:*:*:*:*:*:*
digitransport_wr21-cpe:2.3:h:digi:transport_wr21:-:*:*:*:*:*:*:*
digitransport_wr31_firmware*cpe:2.3:o:digi:transport_wr31_firmware:*:*:*:*:*:*:*:*
digitransport_wr31-cpe:2.3:h:digi:transport_wr31:-:*:*:*:*:*:*:*
digitransport_wr41_firmware*cpe:2.3:o:digi:transport_wr41_firmware:*:*:*:*:*:*:*:*
digitransport_wr41-cpe:2.3:h:digi:transport_wr41:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
digi	transport_wr11_firmware	*	cpe:2.3:o:digi:transport_wr11_firmware::::::::
digi	transport_wr11	-	cpe:2.3:h:digi:transport_wr11:-:::::::*
digi	transport_wr11_xt_firmware	*	cpe:2.3:o:digi:transport_wr11_xt_firmware::::::::
digi	transport_wr11_xt	-	cpe:2.3:h:digi:transport_wr11_xt:-:::::::*
digi	transport_wr21_firmware	*	cpe:2.3:o:digi:transport_wr21_firmware::::::::
digi	transport_wr21	-	cpe:2.3:h:digi:transport_wr21:-:::::::*
digi	transport_wr31_firmware	*	cpe:2.3:o:digi:transport_wr31_firmware::::::::
digi	transport_wr31	-	cpe:2.3:h:digi:transport_wr31:-:::::::*
digi	transport_wr41_firmware	*	cpe:2.3:o:digi:transport_wr41_firmware::::::::
digi	transport_wr41	-	cpe:2.3:h:digi:transport_wr41:-:::::::*

Rows per page:

1-10 of 121

References

raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt

www.digi.com/search/results?q=transport

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

55.6%

JSON

Related for NVD:CVE-2021-37189

prion1 cvelist1 cve1