CVE-2008-7294
published 2011-08-09CVE-2008-7294: Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to…
PriorityP422medium5.8CVSS 2.0
AVNACMAuNCNIPAP
EPSS
1.01%
59.8th percentile
Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Affected
59 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 3.0.195.38 | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — | |
| chrome | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookieshttp://lists.w3.org/Archives/Public/public-webapps/2009JulSep/1148.htmlhttp://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.htmlhttp://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.htmlhttp://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=660053http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookieshttp://lists.w3.org/Archives/Public/public-webapps/2009JulSep/1148.htmlhttp://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.htmlhttp://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.htmlhttp://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=660053
2011-08-09
Published