CVEvulnerability

CVE-2008-4122

7.5 HIGH Published 2008-12-19 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2008-12-19
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses: CWE-319

Description

Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Affected configurations

• joomla joomla\! 1.5.8

Weakness · CWE (1)

CWE-319 Cleartext Transmission of Sensitive Information weakness

Referenced by CWE · observed example (2)

CWE-311 Missing Encryption of Sensitive Data weakness
CWE-319 Cleartext Transmission of Sensitive Information weakness

References

http://int21.de/cve/CVE-2008-4122-joomla.html Third Party Advisory
http://securityreason.com/securityalert/4794 Third Party Advisory
http://www.securityfocus.com/archive/1/499295/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/499354/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
http://int21.de/cve/CVE-2008-4122-joomla.html Third Party Advisory
http://securityreason.com/securityalert/4794 Third Party Advisory
http://www.securityfocus.com/archive/1/499295/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/499354/100/0/threaded Broken Link, Third Party Advisory, VDB Entry