Unscored CVE-2008-3661 EUVD-2008-3647GHSA-q4hh-4qxq-c529

Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be se…

Published Sep 23, 2008 · Updated Aug 7, 2024 · Assigned by mitre

Description

Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

References

31285 vdb-entry
drupal-cookie-session-hijacking(45298) vdb-entry
http://int21.de/cve/CVE-2008-3661-drupal.html
20080920 drupal: Session hijacking vulnerability, CVE-2008-3661 mailing-list