Session fixation

2020-10-2909:15:00

PRIOn knowledge base

www.prio-n.com

4.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.6%

JSON

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

CPENameOperatorVersion
diskstation_managerge6.2
diskstation_managerlt6.2.3
skynas_firmwareeq< 6.2.3-25426

Name	Operator	Version
diskstation_manager	ge	6.2
diskstation_manager	lt	6.2.3
skynas_firmware	eq	< 6.2.3-25426

References

www.synology.com/security/advisory/Synology_SA_20_18