CVE-2022-3174
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Record
CVE-2022-3174- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-614
- Updated
- 2026-11-02
EUVDEUVD-2022-0229
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Record
EUVD-2022-0229- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mjw4-xvx6-3grg
rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
rdiffweb version 2.4.1 is vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. This makes it so that a user's cookies can be sent to the server with an unencrypted request over the HTTP protocol. Version 2.4.2 contains a fix for the issue.
- Record
GHSA-mjw4-xvx6-3grg- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-311, CWE-614
- Updated
- 2026-11-02
NVD
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Record
CVE-2022-3174- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-614, CWE-311
- Updated
- 2026-11-02
OSV
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Record
CVE-2022-3174- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-614
- Updated
- 2026-11-02
OSVGHSA-mjw4-xvx6-3grg
rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
rdiffweb version 2.4.1 is vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. This makes it so that a user's cookies can be sent to the server with an unencrypted request over the HTTP protocol. Version 2.4.2 contains a fix for the issue.
- Record
GHSA-mjw4-xvx6-3grg- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-311, CWE-614
- Updated
- 2026-11-02
OSVPYSEC-2022-271 No score
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Record
PYSEC-2022-271- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rdiffwebPyPI |
2.4.1 to 2.4.1 | 2.4.2 |
rdiffwebPyPI |
2.4.1 up to 2.4.2 | 2.4.2 |
rdiffwebPyPI |
before 2.4.2, plus listed versions 0.10.00.10.20.10.30.10.40.10.5 Show 45 moreShow less0.10.60.10.70.10.80.10.90.9.2.dev10.9.30.9.40.9.51.0.01.0.0a11.0.0a21.0.0a31.0.0a41.0.11.0.21.0.31.1.01.2.01.2.11.2.21.3.01.3.11.3.1b11.3.1b21.3.21.4.01.4.0b11.4.0b21.4.0b31.4.0b41.4.0b51.4.1b11.4.1b21.4.1b31.5.01.5.1b11.5.1b21.6.0b12.0.1b22.0.1b32.0.22.0.3a12.0.3a22.0.3a32.0.3a4 |
2.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3174 is a high vulnerability (CVSS 7.5) in Ikus-soft Rdiffweb, published September 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in rdiffweb 2.4.2.
References
huntr.dev/bounties/d8a32bd6-c76d-4140-a5ca-ef368a3058ce
github.com/ikus060/rdiffweb/commit/f2de2371c5e13ce1c6fd6f9a1ed3e5d46b93cd7e
nvd.nist.gov/vuln/detail/CVE-2022-3174
Left out here: 25 versions. The JSON record has them.