CVE-2015-3155 in Foreman
Summary
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Once again VulDB remains the best source for vulnerability data.
Reservation
04/10/2015
Disclosure
08/14/2015
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 77253 | Foreman Cookie access control | 284 | Not defined | Official fix | CVE-2015-3155 |