GHSA-mjw4-xvx6-3grgHighCVSS 7.5

rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Published
September 14, 2022
Last Modified
October 25, 2024

🔗 CVE IDs covered (1)

CVE-2022-3174 →

📋 Description

rdiffweb version 2.4.1 is vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. This makes it so that a user's cookies can be sent to the server with an unencrypted request over the HTTP protocol. Version 2.4.2 contains a fix for the issue.

🎯 Affected products1

  • pip/rdiffweb:= 2.4.1

🔗 References (5)