CVE-2021-35236

Katalog CVE

CVSS 5.3 · Medium EPSS 0,52%

Kerentanan Sensitive Cookie in HTTPS Session Without 'Secure' Attribute pada solarwinds kiwi syslog server. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.

Rincian

Terbit di NVD

27 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-311: Missing Encryption of Sensitive Data

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm release notes · advisory vendor
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35236 advisory vendor