CVE-2024-10718CWE-614

Cookie without Secure attribute in phpipam/phpipam

Medium · published March 20, 2025

CVSS v3.0
5.3
EPSS
0%
Percentile
25.9
In the wild
Unconfirmed
What it is

In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.9th percentile
Weakness
CWE-614 · Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Cookie without Secure attribute in phpipam/phpipam
    cvelistv5