CVE-2008-3662 Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remot...
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gallery | <= 2.2.5 | No fix listed |
| gallery | = 2.2.0 | No fix listed |
| gallery | = 2.2.1 | No fix listed |
| gallery | = 2.2.2 | No fix listed |
| gallery | = 2.2.3 | No fix listed |
| gallery | = 2.2.4 | No fix listed |
| gallery | <= 1.5.8 | No fix listed |
References
- gallery.menalto.com patch
- gallery.menalto.com patch
- int21.de
- 20080918 menalto gallery: Session hijacking vulnerability, CVE-2008-3662 mailing-list
- 32662 third-party-advisory
- 33144 third-party-advisory
- GLSA-200811-02 vendor-advisory
- 20080918 menalto gallery: Session hijacking vulnerability, CVE-2008-3662 mailing-list
- 31231 vdb-entry
- FEDORA-2008-11230 vendor-advisory
- FEDORA-2008-11258 vendor-advisory