PT-2023-28161 · Cerebrate · Cerebrate

Mokaddem · Published 2023-09-04 · Updated 2023-09-08 · CVE-2023-41908

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cerebrate versions prior to 1.15

Description The issue is related to the lack of the Secure attribute for the session cookie. This means that the session cookie is transmitted over an insecure channel, potentially allowing an attacker to intercept and exploit it.

Recommendations For versions prior to 1.15, update to version 1.15 or later to ensure the Secure attribute is set for the session cookie, thereby encrypting the transmission of the session cookie.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-41908

Affected Products

Cerebrate

References · 7

• https://github.com/cerebrate-project/cerebrate/compare/v1.14...v1.15 · Patch
• https://github.com/cerebrate-project/cerebrate/commit/9be81055651649658243b5aa274b175064bfc6db · Patch
• https://osv.dev/vulnerability/CVE-2023-41908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41908 · Security Note
• https://twitter.com/CVEnew/status/1698944018728816738 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1699018148572266529 · Twitter Post
• https://t.me/cvenotify/57810 · Telegram Post