CVE-2008-3661

Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://int21.de/cve/CVE-2008-3661-drupal.html	Third Party Advisory
http://www.securityfocus.com/archive/1/496575/100/0/threaded	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/31285	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45298	Third Party Advisory VDB Entry
http://int21.de/cve/CVE-2008-3661-drupal.html	Third Party Advisory
http://www.securityfocus.com/archive/1/496575/100/0/threaded	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/31285	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45298	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:drupal:drupal:5.10:::::::*
	cpe:2.3:a:drupal:drupal:6.4:::::::*

History

21 Nov 2024, 00:49

Type	Values Removed	Values Added
References	~~() http://int21.de/cve/CVE-2008-3661-drupal.html - Third Party Advisory~~	() http://int21.de/cve/CVE-2008-3661-drupal.html - Third Party Advisory
References	~~() http://www.securityfocus.com/archive/1/496575/100/0/threaded - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/archive/1/496575/100/0/threaded - Third Party Advisory, VDB Entry
References	~~() http://www.securityfocus.com/bid/31285 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/31285 - Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/45298 - Third Party Advisory, VDB Entry~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/45298 - Third Party Advisory, VDB Entry

Information

Published : 2008-09-23 15:25

Updated : 2024-11-21 00:49

NVD link : CVE-2008-3661

Mitre link : CVE-2008-3661

CVE.ORG link : CVE-2008-3661

JSON object : View

Products Affected

drupal

drupal

CWE

NVD-CWE-Other

{"id": "CVE-2008-3661", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2008-09-23T15:25:42.687", "references": [{"url": "http://int21.de/cve/CVE-2008-3661-drupal.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/496575/100/0/threaded", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/31285", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45298", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://int21.de/cve/CVE-2008-3661-drupal.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/496575/100/0/threaded", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/31285", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45298", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie."}, {"lang": "es", "value": "Drupal, probablemente v5.10 y v6.4, no establece el indicador seguro para la cookie de sesi\u00f3n en una sesi\u00f3n https, lo que puede provocar que sea enviada en una petici\u00f3n http y facilitar a los atacantes remotos el capturar la misma."}], "lastModified": "2024-11-21T00:49:48.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:5.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28BE4DF7-6884-49BA-99D0-FCAE6DB75242"}, {"criteria": "cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB73B2E1-2554-4CA2-9C82-B694509CE43A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}