CVE-2024-47833CWE-1004CWE-614

Session Cookie without Secure and HTTPOnly flags in taipy

Medium · published October 9, 2024

CVSS v4.0
6.3
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00252 · 15.8th percentile
Weaknesses
CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag; CWE-614 · Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Published
2024-10-09T18:25Z
EPSS history
Timeline
  • 09 OCT 18:25Z
    Session Cookie without Secure and HTTPOnly flags in taipy
    cvelistv5