Pascal : Cookie: transmission not over SSL

Classification

OWASP Mobile Top 10 2016 M3-Insecure Communication M4-Insecure Authentication OWASP Top 10 2017 A2-Broken Authentication A3-Sensitive Data Exposure OWASP Top 10 2021 A2-Cryptographic Failures A4-Insecure Design A7-Identification and Authentication Failures OWASP MASVS V5: 5.1.(L1/L2/L1+R/L2+R) V5: 5.2.(L1/L2/L1+R/L2+R) OWASP ASVS Session Management PCI DSS 4.0 4.2.1 6.2.4 HIPAA §164.312 (e)(1) §164.312 (e)(2)(ii) CWE CWE-311 CWE-614 CWE-732 CWE/SANS Top 25 2011 CWE-311 CWE-732 CWE/SANS Top 25 2021 CWE-732

Overview

The application creates cookies without setting the secure flag to True This allows to transfer cookies in clear text over HTTP, which can violate their confidentiality.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2013-A5-Security Misconfiguration
  2. Session Management Cheat Sheet: Cookies: Secure Attribute
  3. OWASP Top 10 2017 A2-Broken Authentication
  4. CWE-614
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication