VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Sep 16, 2022· Updated Jun 17, 2026

CVE-2022-38846

CVE-2022-38846

Description

EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.

Affected products

4
  • Espocrm/Espocrm3 versions
    cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*
    • (no CPE)
    • (no CPE)range: 7.1.8
  • osv-coords
    pkg:bitnami/espocrm
    Range: >= 7.1.8, <= 7.1.8

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.