CVE-2021-40642

Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php

published June 29, 2022

CVSS
—
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.5th percentile
Published
2022-06-29T10:25Z
EPSS history
Timeline
  • 29 JUN 10:25Z
    Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php
    cvelistv5