CVE-2008-3662

{"id": "CVE-2008-3662", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2008-09-18T18:00:00.390", "references": [{"url": "http://gallery.menalto.com/gallery_1.5.9_released", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://gallery.menalto.com/gallery_2.2.6_released", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://int21.de/cve/CVE-2008-3662-gallery.html", "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2008/Sep/0379.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32662", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/33144", "source": "cve@mitre.org"}, {"url": "http://security.gentoo.org/glsa/glsa-200811-02.xml", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/496509/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/31231", "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html", "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html", "source": "cve@mitre.org"}, {"url": "http://gallery.menalto.com/gallery_1.5.9_released", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://gallery.menalto.com/gallery_2.2.6_released", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://int21.de/cve/CVE-2008-3662-gallery.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2008/Sep/0379.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/32662", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/33144", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://security.gentoo.org/glsa/glsa-200811-02.xml", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/496509/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/31231", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie."}, {"lang": "es", "value": "Gallery, versiones anteriores a 1.5.9, 2.x y versiones anteriores a 2.2.6 no asigna el indicador seguro para la cookie de sesi\u00f3n en una sesi\u00f3n https, el cual puede causar que la cookie sea enviada en una petici\u00f3n http y hacer m\u00e1s f\u00e1cil a los atacantes remotos capturar esta cookie."}], "lastModified": "2024-11-21T00:49:49.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gallery:gallery:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F63EDF9A-1818-41D4-96EF-DFF61994C27F", "versionEndIncluding": "2.2.5"}, {"criteria": "cpe:2.3:a:gallery:gallery:2.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAD2DDED-A01D-4026-B8C3-0DA916466D1C"}, {"criteria": "cpe:2.3:a:gallery:gallery:2.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D400C30B-BD93-4419-BEC2-24A470F5E473"}, {"criteria": "cpe:2.3:a:gallery:gallery:2.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8180C4E9-EFC9-438C-AAAF-B09B838CA17E"}, {"criteria": "cpe:2.3:a:gallery:gallery:2.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2ED9F1B-D3BD-42BA-8300-6A719A577F7F"}, {"criteria": "cpe:2.3:a:gallery:gallery:2.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A821D29-75FA-4A6D-BE1A-D11906FA188D"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gallery:gallery:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2630CD9-31D8-4E24-B518-03D94B3383B9", "versionEndIncluding": "1.5.8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}