CVE-2020-27650
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-27650
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
HTTPS会话中未设置’Secure’属性的敏感Cookie
Source: NVD (National Vulnerability Database)
Vulnerability Title
Synology DiskStation Manager 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Synology DiskStation Manager(DSM)是中国台湾(DSM)等都是中国台湾群晖科技(Synology)公司的产品。Synology DiskStation Manager是一套用于网络储存服务器（NAS）上的操作系统。HTTPS(Hypertext Transfer Protocol Secure,超文本传输安全协议)等都是的产品。HTTPS是一种网络安全传输协议，Debian计划 apt等都是Debian计划(Debian计划)合作组织的产品。apt是一个命令行软件包管理器，
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Synology | DiskStation Manager (DSM) | unspecified ~ 6.2.3-25426-2 | - |
II. Public POCs for CVE-2020-27650
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-27650
请登录查看更多情报信息。
- https://www.synology.com/security/advisory/Synology_SA_20_18x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2020-27650
Same Patch Batch · Synology · 2020-10-29 · 11 CVEs total
| CVE-2020-27654 | 9.8 CRITICAL | Synology Router Manager 访问控制错误漏洞 |
| CVE-2020-27652 | 8.3 HIGH | Synology DiskStation Manager 加密问题漏洞 |
| CVE-2020-27648 | 8.3 HIGH | Synology DiskStation Manager 信任管理问题漏洞 |
| CVE-2020-27653 | 8.3 HIGH | Synology Router Manager 加密问题漏洞 |
| CVE-2020-27649 | 8.3 HIGH | Synology Router Manager 信任管理问题漏洞 |
| CVE-2020-27658 | 7.1 HIGH | Synology Router Manager 安全漏洞 |
| CVE-2020-27656 | 6.5 MEDIUM | Synology DiskStation Manager 信息泄露漏洞 |
| CVE-2020-27657 | 6.5 MEDIUM | Synology Router Manager 安全漏洞 |
| CVE-2020-27655 | 6.5 MEDIUM | Synology Router Manager 访问控制错误漏洞 |
| CVE-2020-27651 | 5.8 MEDIUM | Synology Router Manager 安全漏洞 |
IV. Related Vulnerabilities
Same product: DiskStation Manager (DSM)
- CVE-2024-5401
Synology DiskStation Manager和Synology Unified Controller 安全漏 - CVE-2024-45539
Synology DiskStation Manager和Synology Unified Controller 缓冲区 - CVE-2024-45538
Synology DiskStation Manager和Synology Unified Controller 跨站请 - CVE-2025-1021
Synology DiskStation Manager 安全漏洞 - CVE-2024-50629
Synology DiskStation Manager（DSM）和Synology BeeStation Manage
Same weakness: CWE-614
- CVE-2026-22617
Eaton Intelligent Power Protector 安全漏洞 - CVE-2026-4820
IBM Maximo Application Suite was vulnerable to because Cooki - CVE-2026-32745
JetBrains Datalore 安全漏洞 - CVE-2026-1697
Use of unsecure cookies for GraphicalData web service and We - CVE-2024-58317
Kentico Xperience <= 13.0.164 Cookie Security Configuration
V. Comments for CVE-2020-27650
No comments yet