CVE-2008-3663 Information disclosure in n/a

What is CVE-2008-3663?

CVE-2008-3663 is a medium-severity vulnerability in Squirrelmail Squirrelmail, published on 24 Sep 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Weakness: CWE-310

Which versions are affected by CVE-2008-3663?

It affects 1 product.

Products include Squirrelmail Squirrelmail.

How do I fix CVE-2008-3663?

Upgrade to a fixed version.

Is CVE-2008-3663 being exploited?

There is no known exploitation of CVE-2008-3663 in the wild and no public exploit code.

Other vulnerabilities in Squirrelmail Squirrelmail

• CVE-2002-0516 Command injection in n/a Critical 10.0
• CVE-2020-14932 Deserialization in n/a Critical 9.8
• CVE-2020-14933 Deserialization in n/a High 8.8
• CVE-2017-7692 Command injection in n/a High 8.8
• CVE-2007-2631 Cross-site request forgery in n/a High 7.5

All Squirrelmail Squirrelmail vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v6vw-6gwh-pprh.