CVE-2008-4122
published 2008-12-19CVE-2008-4122: Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by…
PriorityP426high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.26%
65.9th percentile
Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| joomla | joomla_! | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Missing Encryption of Sensitive Data
mitre_cwe
CWE-311 Missing Encryption of Sensitive Data
CWE-311: Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Modes of Introduction:
Phase: Architecture and Design
Note: OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Phase: Operation
Common Consequences:
Scope: Confidentiality. Impact: Read Application Data. If the application does not use a secure channel, such as SSL, to exchange sensitive information, it is possible for an attacker with access to the network traffic to sniff packets from the connection and uncover the data. This attack is not technically difficult, but does require physical access to some portion of the network over which the sensitive data travels. This access is usually somewhe
CWE
Cleartext Transmission of Sensitive Information
mitre_cwe
CWE-319 Cleartext Transmission of Sensitive Information
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Modes of Introduction:
Phase: Architecture and Design
Note: OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Phase: Architecture and Design
Note: For hardware, this may be introduced when design does not plan for an attacker having physical access while a legitimate user is remotely operating the device.
Phase: Operation
Phase: System Configuration
Common Consequences:
Scope: Integrity, Confidentiality. Impact: Read Application Data, Modify Files or Directories. Anyone can read the information by gaining access to the channel being used
http://int21.de/cve/CVE-2008-4122-joomla.htmlhttp://securityreason.com/securityalert/4794http://www.securityfocus.com/archive/1/499295/100/0/threadedhttp://www.securityfocus.com/archive/1/499354/100/0/threadedhttp://int21.de/cve/CVE-2008-4122-joomla.htmlhttp://securityreason.com/securityalert/4794http://www.securityfocus.com/archive/1/499295/100/0/threadedhttp://www.securityfocus.com/archive/1/499354/100/0/threaded
2008-12-19
Published