CVE-2022-4409

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq

6.3 MediumFix available

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.46%Down 0.4 points since Dec 12, 2022

What each source reports

CVE List Score used 6.3

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Record: CVE-2022-4409
CVSS 3.0: 6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-614
Updated: 2026-11-02

EUVDEUVD-2022-7764 6.3

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Record: EUVD-2022-7764
CVSS 3.0: 6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wpgc-5cr5-h9gg 7.5

phpMyFAQ has insecure HTTP cookies

phpMyFAQ is contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in versions prior to 3.1.9.

Record: GHSA-wpgc-5cr5-h9gg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-311, CWE-319, CWE-614
Updated: 2026-11-02

NVD 7.5

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Record: CVE-2022-4409
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0: 6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-614, CWE-311
Updated: 2026-11-02

OSV 6.3

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Record: CVE-2022-4409
CVSS 3.0: 6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-614
Updated: 2026-11-02

OSVGHSA-wpgc-5cr5-h9gg 7.5

phpMyFAQ has insecure HTTP cookies

phpMyFAQ is contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in versions prior to 3.1.9.

Record: GHSA-wpgc-5cr5-h9gg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-311, CWE-319, CWE-614
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`thorsten/phpmyfaq` Packagist	before 3.1.9	3.1.9
`thorsten/phpmyfaq` Packagist	before 3.1.9, plus listed versions 2.10.0-alpha2.8.02.8.0-RC2.8.0-RC22.8.0-RC3 Show 45 moreShow less 2.8.0-RC42.8.0-alpha22.8.0-alpha32.8.0-beta2.8.0-beta22.8.0-beta32.8.12.8.102.8.112.8.122.8.132.8.142.8.152.8.162.8.172.8.182.8.192.8.22.8.202.8.212.8.222.8.232.8.242.8.252.8.262.8.272.8.282.8.292.8.32.8.42.8.52.8.62.8.72.8.82.8.92.9.02.9.0-alpha2.9.0-alpha22.9.0-alpha32.9.0-alpha42.9.0-beta2.9.0-beta22.9.0-rc2.9.0-rc22.9.0-rc3	3.1.9

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4409 is a medium vulnerability (CVSS 6.3) in Phpmyfaq, published December 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in thorsten/phpmyfaq 3.1.9.

References

This page doesn't list everything

Left out here: 50 versions. The JSON record has them.