CVEvulnerability

CVE-2008-3661

5.0 MEDIUM Published 2008-09-23 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2008-09-23
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N

Description

Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Affected configurations

• drupal drupal 5.10 • drupal drupal 6.4

References

http://int21.de/cve/CVE-2008-3661-drupal.html Third Party Advisory
http://www.securityfocus.com/archive/1/496575/100/0/threaded Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/31285 Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45298 Third Party Advisory, VDB Entry
http://int21.de/cve/CVE-2008-3661-drupal.html Third Party Advisory
http://www.securityfocus.com/archive/1/496575/100/0/threaded Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/31285 Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45298 Third Party Advisory, VDB Entry