CVE-2008-3662
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie...
CVE-2008-3662 is a medium vulnerability (CVSS 5.0) in Gallery, published September 18, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. No source names a fixed version.
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Exploit likelihood
What each source reports
NVD Score used
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
- Record
CVE-2008-3662- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
- Record
CVE-2008-3662- Updated
- 2026-11-02
EUVDEUVD-2008-3648 No score
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
- Record
EUVD-2008-3648- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-38vp-pppf-865m No score
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie...
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
- Record
GHSA-38vp-pppf-865m- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
security.gentoo.org/glsa/glsa-200811-02.xml
secunia.com/advisories/33144
redhat.com/archives/fedora-package-announce/2008-December/msg00832.html
securityfocus.com/archive/1/496509/100/0/threaded
Show 7 moreShow less
int21.de/cve/CVE-2008-3662-gallery.html
gallery.menalto.com/gallery_2.2.6_released
seclists.org/fulldisclosure/2008/Sep/0379.html
nvd.nist.gov/vuln/detail/CVE-2008-3662
github.com/advisories/GHSA-38vp-pppf-865m