CVE-2008-3662

EPSS 0.87%
Veröffentlicht 18.09.2008 18:00:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 14

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Gallery ≫ Gallery Version <= 2.2.5

Gallery ≫ Gallery Version2.2.0

Gallery ≫ Gallery Version2.2.1

Gallery ≫ Gallery Version2.2.2

Gallery ≫ Gallery Version2.2.3

Gallery ≫ Gallery Version2.2.4

Gallery ≫ Gallery Version <= 1.5.8

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.87%	0.743

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://secunia.com/advisories/32662

http://security.gentoo.org/glsa/glsa-200811-02.xml

http://gallery.menalto.com/gallery_1.5.9_released

Patch

http://gallery.menalto.com/gallery_2.2.6_released

Patch

http://int21.de/cve/CVE-2008-3662-gallery.html

http://seclists.org/fulldisclosure/2008/Sep/0379.html

http://secunia.com/advisories/33144

http://www.securityfocus.com/archive/1/496509/100/0/threaded

http://www.securityfocus.com/bid/31231

https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html

https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html

https://nvd.nist.gov/vuln/detail/CVE-2008-3662

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2008-3662

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2008-3662

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2008-3662