Description
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
References
- GLSA-200811-02 vendor-advisory
- 33144 third-party-advisory
- 32662 third-party-advisory
- FEDORA-2008-11258 vendor-advisory
- 20080918 menalto gallery: Session hijacking vulnerability, CVE-2008-3662 mailing-list
- 31231 vdb-entry
- http://int21.de/cve/CVE-2008-3662-gallery.html
- http://gallery.menalto.com/gallery_2.2.6_released
- http://gallery.menalto.com/gallery_1.5.9_released
- 20080918 menalto gallery: Session hijacking vulnerability, CVE-2008-3662 mailing-list
- FEDORA-2008-11230 vendor-advisory