DerScanner
Home / Vulnerability Database / Config files : Cookie: transmission not over SSL
Config files

Config files : Cookie: transmission not over SSL

Classification

OWASP Mobile Top 10 2016
M3-Insecure CommunicationM4-Insecure Authentication
OWASP Top 10 2017
A2-Broken AuthenticationA3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure DesignA7-Identification and Authentication Failures
OWASP MASVS
V5: 5.1.(L1/L2/L1+R/L2+R)V5: 5.2.(L1/L2/L1+R/L2+R)
OWASP ASVS
Session Management
PCI DSS 4.0
4.2.16.2.4
HIPAA
§164.312 (e)(1)§164.312 (e)(2)(ii)
CWE
CWE-311CWE-614CWE-732
CWE/SANS Top 25 2011
CWE-311CWE-732
CWE/SANS Top 25 2021
CWE-732

Overview

The application creates cookies without setting the secure flag to true This allows to transfer cookies over HTTP in unencrypted form, that can violate their confidentiality.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. The ultimate guide to secure cookies with web.config in .NET
  2. Securing Session INI Settings - php.net
  3. OWASP Top 10 2017 A2-Broken Authentication
  4. OWASP Top 10 2013-A5-Security Misconfiguration
  5. Origin Cookies: Session Integrity for Web Applications (pdf)
  6. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication
  7. CWE-614
LOW

DerScanner Severity Score

Do you want to fix Config files : Cookie: transmission not over SSL in your application?

See also

Config files

Config files : Text4Shell Vulnerability

Config files

Config files : Incorrect directory deletion

Config files

Config files : Code injection