CVE-2024-10718: Cookie without Secure attribute in phpipam/phpipam
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10718?
CVE-2024-10718 is considered a high severity vulnerability due to the potential exposure of sensitive cookies over insecure HTTP connections.
How do I fix CVE-2024-10718?
To fix CVE-2024-10718, upgrade your phpipam installation to version 1.7.0 or later.
What version of phpipam is affected by CVE-2024-10718?
CVE-2024-10718 affects phpipam versions from 1.5.1 to 1.6.x.
What kind of information could be exposed by CVE-2024-10718?
CVE-2024-10718 could expose sensitive information contained in cookies, such as session identifiers and user credentials.
Is CVE-2024-10718 a client-side or server-side vulnerability?
CVE-2024-10718 is primarily a server-side vulnerability as it involves server misconfiguration that affects client interactions.