Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LSynology Router Manager
APPSynology1.2 – 1.2.4-8081 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Related vulnerabilities
CVE-2023-32956CRITICAL9.8PL ✓same product
OS Command Injection w Synology Router Manager (SRM) — RCE bez uwierzytelnienia
CVE-2022-43931CRITICAL10.0PL ✓same product
Podatność out-of-bounds write w Synology VPN Plus Server — RCE bez uwierzytelnienia
CVE-2022-22683CRITICAL10.0PL ✓same product
Classic Buffer Overflow w Synology Media Server umożliwiający RCE
CVE-2020-27654CRITICAL9.8PL ✓same product
RCE w Synology Router Manager przez nieprawidłową kontrolę dostępu w lbd
CVE-2018-1160CRITICAL9.8PL ✓same product
Netatalk: zapis poza zakresem pamięci umożliwia zdalne wykonanie kodu (RCE)