CVE-2024-24768CWE-315

1Panel set-cookie is missing the Secure keyword

Medium · published February 5, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00304 · 22.0th percentile
Weakness
CWE-315 · Cleartext Storage of Sensitive Information in a Cookie
Published
2024-02-05T15:07Z
EPSS history
Timeline
  • 05 FEB 15:07Z
    1Panel set-cookie is missing the Secure keyword
    cvelistv5