Description

Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Remediation

References

CVE-2008-3661

Related Vulnerabilities

GeoServer CVE-2024-35230 Vulnerability (CVE-2024-35230)

Rukovoditel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-44948)

Apache Traffic Server Out-of-bounds Write Vulnerability (CVE-2026-58154)

WordPress Plugin WCFM Membership-WooCommerce Memberships for Multivendor Marketplace Privilege Escalation (2.10.0)

Oracle Database Server CVE-2020-2735 Vulnerability (CVE-2020-2735)

Severity

Medium

Classification

CVE-2008-3661

Tags

Missing Update Known Vulnerabilities