CWE-1275: Sensitive Cookie with Improper SameSite Attribute
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
A kind of CWE-923 Improper Restriction of Communication Channel to Intended Endpoints.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes 5.4 Medium
- asynchttpclient async-http-client AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk 6.9 Medium
- asynchttpclient async-http-client AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts 4.0 Medium
- hatchet-dev hatchet hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState 7.1 High
- http4s Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin 6.8 Medium
- honojs @hono/oauth-providers @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking 5.4 Medium
- spring framework, vmware spring framework +1 more Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse 7.5 High
- openidentityplatform openam OpenAM Insecure SSO Cookie Initialization 7.4 High
- emlog Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover 6.8 Medium
- asynchttpclient async-http-client AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore 4.0 Medium
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() 2.3 Low
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() 2.3 Low
- arcinfo pcvue Use of unsecure cookies for GraphicalData web service and WebClient web app 5.3 Medium
- hcl aion HCL AION is susceptible to Missing SameSite vulnerability 4.6 Medium
- kimai Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking 8.5 High
- ibm sterling b2b integrator, sterling file gateway +1 more IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure 3.7 Low
- hcl bigfix compliance HCL BigFix Compliance is affected by an improper or missing SameSite attribute 5.4 Medium
- hcl software sx, hcltech hcl sx +1 more HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability 5.5 Medium
- otrs Missing CSRF protection 4.8 Medium
- misskey Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes 8.2 High
- ibm concert IBM Concert information disclosure 3.7 Low
- mozilla firefox, thunderbird +1 more Incorrect handling of SameSite cookies 9.8 Critical
- ibm cloud pak for security, qradar suite for software, qradar suite +2 more IBM Cloud Pak for Security information disclosure 5.9 Medium
- samsung internet Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass... 6.5 Medium