PT-2023-28161 · Cerebrate · Cerebrate

Mokaddem · Publicado 2023-09-04 · Atualizado 2023-09-08 · CVE-2023-41908

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cerebrate versions prior to 1.15

Description The issue is related to the lack of the Secure attribute for the session cookie. This means that the session cookie is transmitted over an insecure channel, potentially allowing an attacker to intercept and exploit it.

Recommendations For versions prior to 1.15, update to version 1.15 or later to ensure the Secure attribute is set for the session cookie, thereby encrypting the transmission of the session cookie.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-41908

Produtos afetados

Cerebrate

Referências · 7

• https://github.com/cerebrate-project/cerebrate/compare/v1.14...v1.15 · Correção
• https://github.com/cerebrate-project/cerebrate/commit/9be81055651649658243b5aa274b175064bfc6db · Correção
• https://osv.dev/vulnerability/CVE-2023-41908 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1698944018728816738 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1699018148572266529 · Publicação no Twitter
• https://t.me/cvenotify/57810 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-41908 · Nota de Segurança