CVEvulnerability

CVE-2008-3662

5.0 MEDIUM Published 2008-09-18 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-09-18
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-310

Description

Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Affected configurations

• gallery gallery (<= 2.2.5) • gallery gallery 2.2.0 • gallery gallery 2.2.1 • gallery gallery 2.2.2 • gallery gallery 2.2.3 • gallery gallery 2.2.4 • gallery gallery (<= 1.5.8)

Related

Weakness · not in database (1)

Referenced by CWE · observed example (1)

  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute weakness

References