Fallos del tipo CWE-614

64 resultados

Cookie Sensível Sem Atributo Secure

Um cookie contendo dados sensíveis (sessão, autenticação, token) é enviado sem o atributo Secure, permitindo que um atacante intercepte a transmissão via HTTP não criptografado. O navegador envia o cookie mesmo em conexões inseguras, expondo credenciais ou tokens a quem escuta o tráfego de rede.

Ejemplo

Uma aplicação web autentica um usuário e define Set-Cookie: sessionid=abc123 sem incluir Secure. Se o usuário acessa a página via HTTP (ou é redirecionado antes de HTTPS), o sessionid trafega em claro e um atacante na mesma rede WiFi captura a sessão e se faz passar pelo usuário.

Cómo mitigar

Sempre defina o atributo Secure nos cookies de sessão, autenticação ou qualquer dado sensível (Set-Cookie: sessionid=abc123; Secure; HttpOnly). Force HTTPS em toda a aplicação e redirecione automaticamente requisições HTTP para HTTPS, garantindo que o cookie nunca é transmitido sem criptografia.

CVE-2021-3882MEDIUMSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmbEPSS 1.0%CVE-2022-25151HIGHITarian - Session cookie not protected by HttpOnly flagEPSS 0.8%CVE-2020-27651MEDIUMSynology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easiEPSS 0.8%CVE-2015-3207—In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.EPSS 0.7%CVE-2022-24045—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 0.6%CVE-2022-3174HIGHSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffwebEPSS 0.6%CVE-2020-27650MEDIUMSynology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makesEPSS 0.6%CVE-2021-27764HIGHHCL BigFix WebUI Cookie missing attributesEPSS 0.5%CVE-2022-3251HIGHSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/minarcaEPSS 0.5%CVE-2018-25060LOWMacaron csrf csrf.go missing secure attributeEPSS 0.5%CVE-2020-29024MEDIUMMissing HtppOnly and Secure flagsEPSS 0.5%CVE-2021-35236LOWMissing Secure Flag From SSL CookieEPSS 0.5%CVE-2023-0055LOWSensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyloadEPSS 0.4%CVE-2025-0479HIGHSecurity Misconfiguration Vulnerability in CP Plus RouterEPSS 0.4%CVE-2022-4409MEDIUMSensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaqEPSS 0.4%CVE-2022-3250MEDIUMSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffwebEPSS 0.4%CVE-2024-0349LOWSourceCodester Engineers Online Portal missing secure attributeEPSS 0.4%CVE-2022-4683MEDIUMSensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memosEPSS 0.4%CVE-2022-21940HIGHSensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)EPSS 0.4%CVE-2026-41017MEDIUMApache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxyEPSS 0.4%