Home > Vulnerability Database > CVE-2009-3584

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2009-3584

Date: December 23, 2009

SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Severity Score

5.3

Related Resources (8)

Url: http://secunia.com/advisories/37877

Url: https://nvd.nist.gov/vuln/detail/CVE-2009-3584

Url: https://security-tracker.debian.org/tracker/CVE-2009-3584

Url: http://www.securityfocus.com/archive/1/508559/100/0/threaded

Url: http://www.securityfocus.com/bid/37431

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/54968

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2009-3584

Url: https://www.mend.io/vulnerability-database/CVE-2009-3584

Severity Score

5.3

Weakness Type (CWE)

Configuration

CWE-16

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us