QwikSec

Security Database

CVE

CWE

Training

CWE Database
/

CWE-614

Back to CWE list

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Variant
Draft

Description

The Secure attribute for sensitive cookies in HTTPS sessions is not set.

Common Consequences

Scope

Confidentiality

Impact

Read Application Data

Potential Mitigations

Implementation

Always set the secure attribute when the cookie should be sent via HTTPS only.

CVE-2024-47833

python library for ML and data science does not use the Secure flag for session cookies

CVE-2004-0462

A product does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the product.

CVE-2008-3663

A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CVE-2008-3662

A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CVE-2008-0128

A product does not set the secure flag for a cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now