CVE-2008-3057

Published Dec 3, 2008

Last updated 7 years ago

Overview

Description: Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-310

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:octeth:oempro:3.5.5.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "49F8FE6B-4C4B-4C56-B5DC-36A05678E849"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References