CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Variant
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
Consequences
- Confidentiality: Read Application Data
How to prevent it
- Implementation: Always set the secure attribute when the cookie should be sent via HTTPS only.
Recent advisories
- GHSA-95v7-h9j5-gvjr — Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
- GHSA-f74w-272x-mqcv — NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
- GHSA-34w4-wrqp-j47g — Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq
- GHSA-m3g7-wrrq-v5c8 — Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
- GHSA-qcw2-492v-57xj — usememos/memos missing Secure cookie attribute
- GHSA-wpgc-5cr5-h9gg — phpMyFAQ has insecure HTTP cookies
- GHSA-m748-hjqg-rpp8 — rdiffweb has insecure HTTP cookies
- GHSA-mjw4-xvx6-3grg — rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
- GHSA-379p-37xc-q963 — Mattermost Server does not check if cookies are used over SSL
- GHSA-8255-qf34-44mp — Sensitive Cookie Without HttpOnly and Secure Flag
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor