Description

Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Remediation

References

CVE-2008-3661

Related Vulnerabilities

phpMyAdmin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-1149)

TCExam Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-20115)

WordPress Plugin AP Companion includes Backdoor [Only if downloaded via the vendor website] (1.0.6)

MySQL CVE-2020-2892 Vulnerability (CVE-2020-2892)

WordPress Plugin Wholesale Market for WooCommerce Directory Traversal (1.0.8)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CVE-2008-3661