Lucene search

[email protected]CVE-2021-37189

HistoryDec 10, 2021 - 1:15 p.m.

CVE-2021-37189

2021-12-1013:15:07

CWE-311

[email protected]

web.nvd.nist.gov

cve-2021-37189

digi transport gateway

https

cookie security

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.6%

JSON

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

Affected configurations

NVD

Node

digitransport_wr11_firmwareRange<6.0.0.0

AND

digitransport_wr11Match-

Node

digitransport_wr11_xt_firmwareRange<6.0.0.0

AND

digitransport_wr11_xtMatch-

Node

digitransport_wr21_firmwareRange<6.0.0.0

AND

digitransport_wr21Match-

Node

digitransport_wr31_firmwareRange<6.0.0.0

AND

digitransport_wr31Match-

Node

digitransport_wr41_firmwareRange<6.0.0.0

AND

digitransport_wr41Match-

Node

digitransport_wr44_firmwareRange<6.0.0.0

AND

digitransport_wr44Matchv2

CPENameOperatorVersion
digi:transport_wr11_firmwaredigi transport wr11 firmwarelt6.0.0.0

CPE	Name	Operator	Version
digi:transport_wr11_firmware	digi transport wr11 firmware	lt	6.0.0.0

References

raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt

www.digi.com/search/results?q=transport

Social References

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.6%

JSON

Related for CVE-2021-37189

nvd1 prion1 cvelist1