CVE-2022-3174

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.

Affected

ikus060 · ikus060/rdiffweb

CVSS v4.0 GitHub

7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.0 HUNTR

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.71% chance of exploitation in the next 30 days, 53rd percentile

Published

2022-09-13

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://huntr.dev/bounties/d8a32bd6-c76d-4140-a5ca-ef368a3058ce

Security advisories

• ikus060/rdiffweb/commit/f2de2371c5e13ce1c6fd6f9a1ed3e5d46b93cd7e
• advisories/GHSA-mjw4-xvx6-3grg

References

• CVE Record
• NVD entry