CVE-2022-3250 - OpenCVE

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Ikus-soft	Rdiffweb

Configuration 1 [-]

cpe:2.3:a:ikus-soft:rdiffweb:*:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/ikus060/rdiffweb/commit/ac334dd27ceadac0661b1e2e059a8423433c3fee	Patch Third Party Advisory
https://huntr.dev/bounties/39889a3f-8bb7-448a-b0d4-a18c671bbd23	Exploit Patch Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: @huntrdev

Published: 2022-09-21T16:55:14

Updated: 2022-09-21T16:55:14

Reserved: 2022-09-20T00:00:00

Link: CVE-2022-3250

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-09-21T17:15:09.557

Modified: 2022-09-23T17:00:34.603

Link: CVE-2022-3250

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ikus-soft:rdiffweb:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8399F91-892B-4439-A751-8CE8DA068CBB", "versionEndExcluding": "2.4.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6."}, {"lang": "es", "value": "Una Cookie Confidencial en sesi\u00f3n HTTPS sin atributo \"Secure\" en el repositorio de GitHub ikus060/rdiffweb versiones anteriores a 2.4.6"}], "id": "CVE-2022-3250", "lastModified": "2022-09-23T17:00:34.603", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 1.5, "impactScore": 3.4, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-21T17:15:09.557", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ikus060/rdiffweb/commit/ac334dd27ceadac0661b1e2e059a8423433c3fee"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/39889a3f-8bb7-448a-b0d4-a18c671bbd23"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-614"}], "source": "security@huntr.dev", "type": "Secondary"}]}