CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
VendorProductVersion
squirrelmailsquirrelmail
1.4.15
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
squirrelmail
intrepid
not-affected
hardy
Fixed 2:1.4.13-2ubuntu1.2
released
gutsy
Fixed 2:1.4.10a-2ubuntu0.1
released
feisty
ignored
dapper
Fixed 2:1.4.6-1ubuntu0.2
released
Common Weakness Enumeration
References
http://int21.de/cve/CVE-2008-3663-squirrelmail.html
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/33937
http://securityreason.com/securityalert/4304
http://support.apple.com/kb/HT3438
http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html
http://www.securityfocus.com/archive/1/496601/100/0/threaded
http://www.securityfocus.com/bid/31321
https://exchange.xforce.ibmcloud.com/vulnerabilities/45700
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10548
http://int21.de/cve/CVE-2008-3663-squirrelmail.html
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/33937
http://securityreason.com/securityalert/4304
http://support.apple.com/kb/HT3438
http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html
http://www.securityfocus.com/archive/1/496601/100/0/threaded
http://www.securityfocus.com/bid/31321
https://exchange.xforce.ibmcloud.com/vulnerabilities/45700
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10548