GitHub Advisoryadvisory · Packagist
GHSA-8255-qf34-44mp Sensitive Cookie Without HttpOnly and Secure Flag
HIGH
Official page ↗
- Aliases
- CVE-2017-1000046
- Ecosystem
- Packagist
- Packages
- mautic/core
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-614
- Reviewed
- 2024-04-23
Affected packages
• Packagist mautic/core: < 2.1.1 → fixed in 2.1.1
Description
Mautic prior to 2.1.1 fails to set flags on session cookies
Related
Alias · CVE (1)
- CVE-2017-1000046 Mautic 2.6.1 and earlier fails to set flags on session cookies vulnerability
Weakness · CWE (1)
- CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000046 advisory
- https://github.com/mautic/mautic/issues/1969 web
- https://github.com/mautic/mautic/pull/2311 web
- https://github.com/mautic/mautic/pull/2311/commits/f9e7981f4acf0d37fd935c9b9d5d09d7e1a49bc6 web
- https://github.com/mautic/mautic package
- https://www.trustmatta.com/advisories/MATTA-2017-002.txt web