3.7low
CVE-2024-44575
RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to…
Published 2 y ago · modified 4 mo ago · JSON
CVSS
3.7
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 17%
Public exploits
0
none known
Summary
RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.25% probability of exploitation in the next 30 days, higher than 17% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Classification
- Weakness
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
- relyum.com /web/support/vulnerability-report/
Sources
- CVE List: CVE-2024-44575
- NVD: CVE-2024-44575
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.