TI-2021-14129 Aliases CVE-2021-35236 GHSA-7fqp-g334-ghhw

Missing Secure Flag From SSL Cookie

LOW 25CWE-614Published 2021-10-27 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-311.

Summary

The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.

Why it matters now

EPSS 0.00519 44th percentileScored 2026-11-07

Fix Fixed Kiwi Syslog Server (SolarWinds): 9.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SolarWinds	Kiwi Syslog Server	9.7.2 and Previous Versions to before 9.8	9.8	Patch available	CNA

Kiwi Syslog Server VendorSolarWinds Affected 9.7.2 and Previous Versions to before 9.8 Fixed in 9.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:solarwinds:kiwi_syslog_server::::::::	up to 9.7.2	Vulnerable	SolarWinds

cpe:2.3:a:solarwinds:kiwi_syslog_server:*:*:*:*:*:*:*:* Versions up to 9.7.2 Vulnerable ·SolarWinds

Remediation

Fix · CNA Kiwi Syslog Server (SolarWinds) Fixed in 9.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-10-27
SolarWinds Kiwi Syslog Server 9.8
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-14128 ASP.NET Debug Feature EnabledPriority LOW 27
- TI-2021-14126 HTTP TRACK & TRACE Methods EnabledPriority LOW 26
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-35236
2026-10-03 Alias added: GHSA-7fqp-g334-ghhw

References

Advisory 2

TI-2021-14124 Unquoted Path (SMB Login) Vulnerability CVSS 3.1MEDIUM 6.7
TI-2021-14128 ASP.NET Debug Feature Enabled CVSS 3.1MEDIUM 5.3
TI-2021-14126 HTTP TRACK & TRACE Methods Enabled CVSS 3.1MEDIUM 5.3
TI-2021-14130 Clickjacking in SolarWinds Kiwi Syslog Server CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences