CVEvulnerability
CVE-2008-3663
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-09-24
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Affected configurations
• squirrelmail squirrelmail 1.4.15
Related
Weakness · not in database (1)
Referenced by CWE · observed example (1)
- CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute weakness
References
- http://int21.de/cve/CVE-2008-3663-squirrelmail.html int21.de
- http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html lists.apple.com
- http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html lists.opensuse.org
- http://secunia.com/advisories/33937 secunia.com
- http://securityreason.com/securityalert/4304 securityreason.com
- http://support.apple.com/kb/HT3438 support.apple.com
- http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html www.nabble.com
- http://www.securityfocus.com/archive/1/496601/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31321 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45700 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10548 oval.cisecurity.org
- http://int21.de/cve/CVE-2008-3663-squirrelmail.html int21.de
- http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html lists.apple.com
- http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html lists.opensuse.org
- http://secunia.com/advisories/33937 secunia.com
- http://securityreason.com/securityalert/4304 securityreason.com
- http://support.apple.com/kb/HT3438 support.apple.com
- http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html www.nabble.com
- http://www.securityfocus.com/archive/1/496601/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31321 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45700 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10548 oval.cisecurity.org