CVE-2022-38846

EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP)

published September 16, 2022

CVSS
—
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Published
2022-09-16T13:15Z
EPSS history
Timeline
  • 16 SEP 13:15Z
    EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP)
    cvelistv5