GitHub Advisoryadvisory · Packagist

GHSA-wpgc-5cr5-h9gg phpMyFAQ has insecure HTTP cookies

HIGH Published 2022-12-11 Modified 2022-12-13 Official page ↗
Aliases
CVE-2022-4409
Ecosystem
Packagist
Packages
thorsten/phpmyfaq
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-311, CWE-319, CWE-614
Reviewed
2022-12-12

Affected packages

• Packagist thorsten/phpmyfaq: < 3.1.9 → fixed in 3.1.9

Description

phpMyFAQ is contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in versions prior to 3.1.9.

Related

Alias · CVE (1)

  • CVE-2022-4409 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. vulnerability

Weakness · CWE (3)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute weakness

References