VYPR

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

VariantDraft

Description

The Secure attribute for sensitive cookies in HTTPS sessions is not set.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-102

CVEs mapped to this weakness (67)

page 4 of 4
  • CVE-2026-57948MedJun 29, 2026
    risk 0.00cvss 6.8epss 0.00

    Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP.…

  • CVE-2024-10718HigMar 20, 2025
    risk 0.00cvss 7.5epss 0.00

    In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0.

  • CVE-2025-24897HigFeb 11, 2025
    risk 0.00cvss 8.2epss 0.00

    Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of…

  • CVE-2023-4654LowAug 31, 2023
    risk 0.00cvss 3.5epss 0.00

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

  • CVE-2023-3520MedJul 6, 2023
    risk 0.00cvss 4.6epss 0.00

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.

  • CVE-2022-3251MedSep 21, 2022
    risk 0.00cvss 5.3epss 0.01

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.

  • CVE-2021-3882MedOct 14, 2021
    risk 0.00cvss 6.8epss 0.01

    LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the authentication data…