Lucene search

@huntrdevCVE-2023-4654

HistoryAug 31, 2023 - 1:15 a.m.

CVE-2023-4654

2023-08-3101:15:10

CWE-614

@huntrdev

web.nvd.nist.gov

cve-2023-4654

sensitive cookie

https

session

secure attribute

github

repository

nvd

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

4.1

Confidence

High

EPSS

0.001

Percentile

23.9%

JSON

Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

Affected configurations

Nvd

Node

instantcmsinstantcmsRange<2.16.1

VendorProductVersionCPE
instantcmsinstantcms*cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
instantcms	instantcms	*	cpe:2.3:a:instantcms:instantcms::::::::

CNA Affected

[
  {
    "vendor": "instantsoft",
    "product": "instantsoft/icms2",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.16.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/instantsoft/icms2/commit/ca5f150da11d9caae86638885137afe35bcc3592

huntr.dev/bounties/56432a75-af43-4b1a-9307-bd8de568351b

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

4.1

Confidence

High

EPSS

0.001

Percentile

23.9%

JSON

Related for CVE-2023-4654