PT-2023-28161 · Cerebrate · Cerebrate

Mokaddem · CVE-2023-41908 · Published 2023-09-04 · Updated 2023-09-08

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cerebrate versions prior to 1.15

Description The issue is related to the lack of the Secure attribute for the session cookie. This means that the session cookie is transmitted over an insecure channel, potentially allowing an attacker to intercept and exploit it.

Recommendations For versions prior to 1.15, update to version 1.15 or later to ensure the Secure attribute is set for the session cookie, thereby encrypting the transmission of the session cookie.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-41908

Affected Products

Cerebrate

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41908.json · Exploit
• https://github.com/cerebrate-project/cerebrate/commit/9be81055651649658243b5aa274b175064bfc6db · Patch
• https://github.com/cerebrate-project/cerebrate/compare/v1.14...v1.15 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-41908 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41908 · Vendor Advisory
• https://twitter.com/CVEnew/status/1698944018728816738 · Twitter Post
• https://t.me/cvenotify/57810 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699018148572266529 · Twitter Post