CVE-2021-40650: In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set

Medium severity · published Jun 14, 2022

CVE-2021-40650

In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set

6.5

CVSS

0.8%

EPSS

On KEV

Description

In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Connx · Softwareag

6.2.0.1269 · source: NVD

Affected product

Connx

Softwareag

All Connx CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-40650

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-40650

Exploit

https://github.com/l00neyhacker/CVE-2021-40650