PT-2009-5867 · Sql Ledger+1 · Sql-Ledger+1

Publicado 2009-12-23 · Atualizado 2018-10-10 · CVE-2009-3584

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SQL-Ledger version 2.8.24

Description The issue allows remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag for the session cookie is not set in an https session.

Recommendations For SQL-Ledger version 2.8.24, consider setting the secure flag for the session cookie manually to prevent it from being transmitted over an insecure http session. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2009-3584

Produtos afetados

Debian

Sql-Ledger

Referências · 14

• https://nvd.nist.gov/vuln/detail/CVE-2009-3584 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2009-3584 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2009-3584 · Aviso do Fabricante
• http://secunia.com/advisories/37877 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-3584 · Aviso do Fabricante
• http://securityfocus.com/bid/37431 · Nota
• http://securityfocus.com/archive/1/508559/100/0/threaded · Nota
• https://security-tracker.debian.org/tracker/source-package/sql-ledger · Aviso do Fabricante
• https://packages.debian.org/src:sql-ledger · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3584 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3584 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2009-3584 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-3584 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54968 · Nota