Описание
Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Ссылки
- Vendor Advisory
- ExploitThird Party Advisory
- Vendor Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
EPSS
7.1 High
CVSS3
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Уязвимость операционной системы Synology Router Manager (SRM), связанная с отсутствием флага «HttpOnly» в файлах cookie сеанса, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
7.1 High
CVSS3
6.1 Medium
CVSS3
4.3 Medium
CVSS2