What is GHSA-m3g7-wrrq-v5c8?

GHSA-m3g7-wrrq-v5c8 is a security advisory published by GitHub Security Advisories with Medium severity. Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Which CVE IDs does GHSA-m3g7-wrrq-v5c8 cover?

GHSA-m3g7-wrrq-v5c8 covers the following CVE IDs: CVE-2023-0055. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m3g7-wrrq-v5c8?

GHSA-m3g7-wrrq-v5c8 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-m3g7-wrrq-v5c8?

GHSA-m3g7-wrrq-v5c8 affects 1 product, including: pip/pyload-ng:\u003c 0.5.0b3.dev32.

GHSA-m3g7-wrrq-v5c8MediumCVSS 5.3

Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Vendor

GitHub Security Advisories

Published

January 5, 2023

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2023-0055 →

📋 Description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session. This issue is patched in version 0.5.0b3.dev32.

🎯 Affected products1

pip/pyload-ng:< 0.5.0b3.dev32

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-0055
https://github.com/pyload/pyload/commit/7b53b8d43c2c072b457dcd19c8a09bcfc3721703
https://huntr.dev/bounties/ed88e240-99ff-48a1-bf32-8e1ef5f13cce
https://github.com/advisories/GHSA-m3g7-wrrq-v5c8