CVE-2020-27658: High severity Synology Router Manager vulnerability
Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-27658?
CVE-2020-27658 is a vulnerability in Synology Router Manager (SRM) that allows remote attackers to obtain potentially sensitive information via script access to the session cookie.
How does CVE-2020-27658 affect Synology Router Manager?
CVE-2020-27658 affects Synology Router Manager versions before 1.2.4-8081 by not including the HTTPOnly flag in the Set-Cookie header for the session cookie.
What is the severity of CVE-2020-27658?
CVE-2020-27658 has a severity rating of high with a CVSS score of 6.1.
How can remote attackers exploit CVE-2020-27658?
Remote attackers can exploit CVE-2020-27658 by using script access to the session cookie, which allows them to obtain potentially sensitive information.
Are there any references for more information about CVE-2020-27658?
Yes, you can find more information about CVE-2020-27658 at the following references: [Synology Security Advisory](https://www.synology.com/security/advisory/Synology_SA_20_14), [TALOS Intelligence](https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1086).