PT-2021-20858 · Unknown · Kiwi Syslog Server

Published 2021-10-27 · Updated 2022-10-27 · CVE-2021-35236

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Kiwi Syslog Server versions 9.7.2 and earlier

Description: The Secure flag is not set in the SSL Cookie, which means the cookie can be sent over unencrypted requests if the application is accessible over both HTTP and HTTPS. This poses a risk as the cookie can be passed in clear text. The Secure attribute is intended to protect the cookie by only allowing it to be sent over a secure channel, such as HTTPS.

Recommendations: For Kiwi Syslog Server versions 9.7.2 and earlier, consider configuring the application to only be accessible over HTTPS to minimize the risk of the cookie being sent in clear text. As a temporary workaround, restrict access to the application over HTTP until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-614

CWE-311

Related Identifiers

CVE-2021-35236

Affected Products

Kiwi Syslog Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-35236 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35236 · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/cve-2021-35236 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm · Vendor Advisory
• https://t.me/cvenotify/22457 · Telegram Post
• https://t.me/cvenotify/22430 · Telegram Post