Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2021-35236 Details

Description

The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CNA: [email protected]CVSS-B:3.1 LOWVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm	CVE	Release NotesVendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35236	CVE	Vendor Advisory
https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm	[email protected]	Release NotesVendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35236	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-311	Missing Encryption of Sensitive Data	[email protected]
CWE-614	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	[email protected]

Affected Products

Product	Versions
solarwinds kiwi syslog server	<= 9.7.2
CPE cpe:2.3:a:solarwinds:kiwi_syslog_server:::::::: Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Oct 27, 2022	Reanalysis	[email protected]
Oct 28, 2021	Initial Analysis	[email protected]