CVE-2009-5051 - Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session

Back Back to CVE browser

MEDIUM

Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session

Published Jan 18, 2011

5.0

MEDIUM

CVSS 2.0

EPSS 1.06%

Description

Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-16

References (3)

http://www.hastymail.org/security/
x_refsource_CONFIRMPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-5008
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/64891
vdb-entryx_refsource_XF

Link	Providers	Tags
http://www.hastymail.org/security/		x_refsource_CONFIRMPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-5008		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/64891		vdb-entryx_refsource_XF