CVE-2023-3520

low-risk
Published 2023-07-06

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.6/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Openitcockpit

Affected Vendors

It-Novum

References (4)

Patch https://github.com/it-novum/openitcockpit/commit/6c717f3c352e55257fc3fef2c5dec11...
Exploit https://huntr.dev/bounties/f3b277bb-91db-419e-bcc4-fe0b055d2551
Patch https://github.com/it-novum/openitcockpit/commit/6c717f3c352e55257fc3fef2c5dec11...
Exploit https://huntr.dev/bounties/f3b277bb-91db-419e-bcc4-fe0b055d2551
24
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal