software composition analysis
Product
SAST
Catch vulnerabilities as you develop DAST
Test live web applications like an attacker SCA
Secure open-source and supply chain MAST
Secure mobile apps from code to store Compliance
Align with standards while shipping secure code
Resources
Vulnerability database Healthy Package
Blog News
Documentation
Pricing Partners About Us Log In
software composition analysis

Android : Cookie: transmission not over SSL

Classification

OWASP Mobile Top 10 2016 M3-Insecure Communication M4-Insecure Authentication OWASP Top 10 2017 A2-Broken Authentication A3-Sensitive Data Exposure OWASP Top 10 2021 A2-Cryptographic Failures A4-Insecure Design A7-Identification and Authentication Failures OWASP MASVS V5: 5.1.(L1/L2/L1+R/L2+R) V5: 5.2.(L1/L2/L1+R/L2+R) OWASP ASVS Session Management PCI DSS 4.0 4.2.1 6.2.4 HIPAA §164.312 (e)(1) §164.312 (e)(2)(ii) CWE CWE-311 CWE-614 CWE-732 CWE/SANS Top 25 2011 CWE-311 CWE-732 CWE/SANS Top 25 2021 CWE-732

Overview

The application creates cookies without setting the secure flag to true This allows to transfer cookies in clear text over HTTP, which can violate their confidentiality.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2013-A5-Security Misconfiguration
  2. OWASP Top 10 2017-A2-Broken Authentication
  3. CWE-614
  4. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication

See also

Android : Cookie: not HttpOnly
Android : Unsafe SSL or TLS versions
Android : Telephony usage