DerScanner
Home / Vulnerability Database / PHP : Cookie disabled
PHP

PHP : Cookie disabled

Classification

OWASP Top 10 2013
A2-Broken Authentication and Session Management
OWASP Top 10 2017
A2-Broken AuthenticationA3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure DesignA7-Identification and Authentication Failures
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (e)(1)
CWE
CWE-1028

Overview

The application does not use cookies to transmit session identifiers. This allows attacks such as “session hijacking” and “session fixation”.

Most web applications use session IDs, which are transferred between client and server via cookies. Applications that do not store session IDs in cookies often transfer them as a HTTP-request parameter or as a part of the URL. Web servers, application servers, and proxy servers often store requested URLs in a log file. The more sources contain session identifiers, the greater the risk of them being compromised.

In the given case the value of session.use_cookies or of session.use_only_cookies is equal to 0 or off.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2017 A2-Broken Authentication
  2. CWE-384: Session Fixation
  3. OWASP Top 10 2013-A5-Security Misconfiguration
  4. Origin Cookies: Session Integrity for Web Applications (pdf)
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication
MEDIUM

DerScanner Severity Score

Do you want to fix PHP : Cookie disabled in your application?

See also

PHP

PHP : Null salt

PHP

PHP : Empty password

PHP

PHP : Empty salt