CVE-2008-3661: Medium severity drupal vulnerability

Published Sep 23, 2008

Updated

Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Affected Software

2 affected components

Drupal Drupal=5.10

Drupal Drupal=6.4

Event History

Sep 23, 2008

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3661?

CVE-2008-3661 is considered a medium severity vulnerability due to the risk of session cookies being exposed to attackers.

How do I fix CVE-2008-3661?

To fix CVE-2008-3661, ensure that the secure flag is set for session cookies in your Drupal configuration during HTTPS sessions.

Which versions of Drupal are affected by CVE-2008-3661?

CVE-2008-3661 affects Drupal versions 5.10 and 6.4.

What is the impact of CVE-2008-3661?

The impact of CVE-2008-3661 allows attackers to potentially capture session cookies, leading to unauthorized access.

Is there a patch available for CVE-2008-3661?

Yes, upgrading to newer versions of Drupal that properly set the secure flag for session cookies will mitigate CVE-2008-3661.