PT-2009-5867 · Sql Ledger+1 · Sql-Ledger+1

Published 2009-12-23 · Updated 2018-10-10 · CVE-2009-3584

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SQL-Ledger version 2.8.24

Description The issue allows remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag for the session cookie is not set in an https session.

Recommendations For SQL-Ledger version 2.8.24, consider setting the secure flag for the session cookie manually to prevent it from being transmitted over an insecure http session. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-3584

Affected Products

Debian

Sql-Ledger

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2009-3584 · Security Note
• https://cve.org/CVERecord?id=CVE-2009-3584 · Security Note
• https://osv.dev/vulnerability/CVE-2009-3584 · Vendor Advisory
• http://secunia.com/advisories/37877 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3584 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/sql-ledger · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3584 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3584 · Vendor Advisory
• https://ubuntu.com/security/CVE-2009-3584 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-3584 · Vendor Advisory
• http://securityfocus.com/bid/37431 · Note
• http://securityfocus.com/archive/1/508559/100/0/threaded · Note
• https://packages.debian.org/src:sql-ledger · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54968 · Note