CVE-2015-3207 — Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in Openshift Origin

CWE-614 — Sensitive Cookie in HTTPS Session Without 'Secure' AttributeCWE-311 — Missing Encryption of Sensitive Data5 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 57.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Openshift OriginOpenshift Origin
Timeline
PublishedJul 7
Latest updateAug 21

Description

In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDopenshift/origin3.0.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Insecure cookies in Openshift Origin in github.com/openshift/origin↗2024-08-21
▶
OSV
Insecure cookies in Openshift Origin↗2022-07-08
▶
GHSA
Insecure cookies in Openshift Origin↗2022-07-08
▶

📋Vendor Advisories

1
Red Hat
github.com/openshift/origin: Insecure cookies in Openshift Origin in github.com/openshift/origin↗2020-07-07
▶