The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-42699
• https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02