CVE Vulnerability

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

References
Link Resource
http://int21.de/cve/CVE-2008-3663-squirrelmail.html
http://www.securityfocus.com/bid/31321
http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html
http://securityreason.com/securityalert/4304
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/33937
http://support.apple.com/kb/HT3438
https://exchange.xforce.ibmcloud.com/vulnerabilities/45700
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10548
http://www.securityfocus.com/archive/1/496601/100/0/threaded
Configurations

Configuration 1

cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*
Information

Published : 2008-09-24 02:56

Updated : 2018-10-11 08:49

NVD link : CVE-2008-3663

Mitre link : CVE-2008-3663

Products Affected
No products.
CWE
CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute