CVE Catalog
CVE-2021-40650
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.73%
50th percentile - higher than 50% of all known CVEs
Summary
In Connx version 6.2.0.1269 (20210623), the application may issue a cookie without the Secure flag set. This means the cookie can be transmitted over unencrypted HTTP connections.
Risk Assessment
The missing Secure flag increases the risk of session hijacking by an attacker, especially on public networks or during man-in-the-middle attacks.
Recommendation
It is recommended to update Connx to a version where the Secure flag is set by default for all cookies. If an update is not possible, manually configure the application to enforce the Secure flag.
Original NVD description (English source)
In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set.