CVE-2020-27658CWE-1004

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for…

High · published October 29, 2020

CVSS v3.1
7.1
EPSS
1%
Percentile
70.5
In the wild
Unconfirmed
What it is

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01313 · 70.5th percentile
Weakness
CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag
Published
2020-10-29T08:55Z
EPSS history
Timeline
  • 29 OCT 08:55Z
    Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for…
    cvelistv5