Orta CVSS 5.4
CVE-2026-78188: CVE-2026-78188: güvenlik açığı
Açıklama (NVD)
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
Özet bilgiler
- CVSS v3.1
- 5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - EPSS
- %0,13 (yüzdelik 2)
- CWE
- CWE-614
- Yama
- Yok / bilinmiyor