VulnerabilityModified
CVE-2008-3057
Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http…
MEDIUM 5.0EPSS 1.32%
Does this matter?
Lower severity and a low EPSS score (1.32%). Track it; it rarely justifies an emergency change on its own.
Description
Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.32% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- octeth/oempro
- Source
- cve@mitre.org
References
- http://octeth.com/blog/category/oempro4/
- http://osvdb.org/ref/50/oempro.txtExploit
- http://www.osvdb.org/50321
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47109
- http://octeth.com/blog/category/oempro4/
- http://osvdb.org/ref/50/oempro.txtExploit
- http://www.osvdb.org/50321
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47109
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.