CVE-2008-3662

Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Link	Resource
http://gallery.menalto.com/gallery_1.5.9_released	Patch
http://int21.de/cve/CVE-2008-3662-gallery.html
http://gallery.menalto.com/gallery_2.2.6_released	Patch
http://www.securityfocus.com/bid/31231
http://seclists.org/fulldisclosure/2008/Sep/0379.html
http://security.gentoo.org/glsa/glsa-200811-02.xml
http://secunia.com/advisories/32662
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html
http://secunia.com/advisories/33144
http://www.securityfocus.com/archive/1/496509/100/0/threaded

Configuration 1

cpe:2.3:a:gallery:gallery:2.2.0:*:*:*:*:*:*:* cpe:2.3:a:gallery:gallery:2.2.3:*:*:*:*:*:*:* cpe:2.3:a:gallery:gallery:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:gallery:gallery:2.2.4:*:*:*:*:*:*:* cpe:2.3:a:gallery:gallery:*:*:*:*:*:*:*:* cpe:2.3:a:gallery:gallery:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:gallery:gallery:*:*:*:*:*:*:*:*

---

Published : 2008-09-18 06:00

Updated : 2018-10-11 08:49

---

NVD link : CVE-2008-3662

Mitre link : CVE-2008-3662

No products.

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute