CVE-2008-3662

Sažetak

Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Reference

http://gallery.menalto.com/gallery_1.5.9_released
http://gallery.menalto.com/gallery_2.2.6_released
http://int21.de/cve/CVE-2008-3662-gallery.html
http://seclists.org/fulldisclosure/2008/Sep/0379.html
http://secunia.com/advisories/32662
http://secunia.com/advisories/33144
http://security.gentoo.org/glsa/glsa-200811-02.xml
http://www.securityfocus.com/archive/1/496509/100/0/threaded
http://www.securityfocus.com/bid/31231
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html

CVSS

Base:	5.0
Impact:	2.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	NONE

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:N/A:N

Zadnje važnije ažuriranje

11-10-2018 - 20:49

Objavljeno

18-09-2008 - 18:00