title: Missing Secure Flag From SSL Cookie
description: The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.
problem types: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
affected:
{
product: Kiwi Syslog Server
vendor: SolarWinds
versions:
lessThan: 9.8, status: affected, version: 9.7.2 and Previous Versions, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
]
solutions: SolarWinds advises Kiwi Syslog Server customers to upgrade to the latest version (9.8) once it becomes generally available.