PT-2011-1312 · Hastymail · Hastymail2

Published 2011-01-18 · Updated 2017-08-17 · CVE-2009-5051

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hastymail2 versions prior to RC 8

Description The issue allows remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag for the session cookie is not set in an https session.

Recommendations For versions prior to RC 8, update to RC 8 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-5051

Affected Products

Hastymail2

References · 3

• http://hastymail.org/security · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-5051 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64891 · Note