rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

ALTO 7.5CVE-2022-3174 · GHSA-mjw4-xvx6-3grg · PYSEC-2022-271 · Published 13/09/2022 · updated 17/06/2026

En resumen

CVE-2022-3174 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a rdiffweb, rdiffweb (ikus-soft).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.71%, mayor que el 53.4% de las vulnerabilidades.
Solución: actualizar a 2.4.2 o posterior.

Package	Affected versions	Patched versions
rdiffweb PyPI	`≥ 2.4.1, < 2.4.2< 2.4.2`	`2.4.2`
rdiffweb ikus-soft	`< 2.4.2`	`2.4.2`

Description

rdiffweb version 2.4.1 is vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. This makes it so that a user's cookies can be sent to the server with an unencrypted request over the HTTP protocol. Version 2.4.2 contains a fix for the issue.

NVD description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.

References

nvd.nist.gov/vuln/detail/CVE-2022-3174 · ADVISORY
ikus060/rdiffweb commit f2de237 · WEB
GitHub Advisory GHSA-mjw4-xvx6-3grg · ADVISORY
ikus060/rdiffweb · PACKAGE
pypa/advisory-database · WEB
huntr.dev/bounties/d8a32bd6-c76d-4140-a5ca-ef368a3058ce · WEB

Más vulnerabilidades de rdiffweb

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

rdiffweb

PyPI

≥ 2.4.1, < 2.4.2< 2.4.2

2.4.2

rdiffweb

ikus-soft

< 2.4.2

2.4.2

Description

NVD description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.

Más vulnerabilidades de rdiffweb

Ver todo →