CVE-2015-3155

foreman: the _session_id cookie is issued without the Secure flag

Published Aug 14, 2015 CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed
Description
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2015-3235 Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 5:39 AM
Reserved
Apr 10, 2015, 12:00 AM
Status
Modified
Published
Aug 14, 2015, 6:59 PM
Modified
Jun 17, 2026, 12:25 AM
Severity
Moderate
Public date
Apr 27, 2015, 12:00 AM