CVE-2008-3663

Description

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

References

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10548

https://exchange.xforce.ibmcloud.com/vulnerabilities/45700

http://www.securityfocus.com/bid/31321

http://www.securityfocus.com/archive/1/496601/100/0/threaded

http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html

http://support.apple.com/kb/HT3438

http://securityreason.com/securityalert/4304

http://secunia.com/advisories/33937

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html

http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html

http://int21.de/cve/CVE-2008-3663-squirrelmail.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3