CVE-2022-4630 : Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradiu

Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.

Published 2022-12-21 18:15:09

Updated 2022-12-28 18:54:35

Source huntr.dev

View at NVD, CVE.org

Products affected by CVE-2022-4630

Daloradius » Daloradius » Version: N/A
cpe:2.3:a:daloradius:daloradius:-:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.3	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N	1.6	3.6	huntr.dev
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)
CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Assigned by: security@huntr.dev (Secondary)

https://huntr.dev/bounties/401661ee-40e6-4ee3-a925-3716b96ece5c

Session cookie without 'HttpOnly' Flag vulnerability found in daloradius
Exploit;Patch;Third Party Advisory
https://github.com/lirantal/daloradius/commit/6878619dc661b3009429777a1aeeb383ddc0166b

Improved attribute dictionaries management feature (#316) · lirantal/daloradius@6878619 · GitHub
Patch;Third Party Advisory

Jump to