5.3

CVE-2022-3250

Exploit

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ikus-soft ≫ Rdiffweb Version < 2.4.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.301
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
security@huntr.dev 4.9 1.5 3.4
CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

https://github.com/ikus060/rdiffweb/commit/ac334dd27ceadac0661b1e2e059a8423433c3fee
Patch
Third Party Advisory
https://huntr.dev/bounties/39889a3f-8bb7-448a-b0d4-a18c671bbd23
Patch
Third Party Advisory
Exploit