Weakness (CWE)
CWE-1275: Sensitive Cookie with Improper SameSite Attribute
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
How to prevent it (1 mitigation)
-
Implementation
Set the SameSite attribute of a sensitive cookie to "Lax" or "Strict". This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the "Lax" value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more likely to cause side-effects of state mutation.
Source: MITRE CWE-1275
2 results · Clear filters · Feed
-
Critical 9.8
Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a…
-
Critical 9.8
Incorrect handling of SameSite cookies
A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.