CVE-2023-5035
Cookie Without Secure Flag
- State
- Published
- Severity
- 3.1 Low
- Published
- Nov 2, 2023
- Updated
- Sep 5, 2024
- Reserved
- Sep 18, 2023
Description
A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N | Moxa |
Weaknesses
- CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected Products
| Product | Versions |
|---|---|
PT-G503 SeriesMoxa |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.