CVE-2024-10718 Cookie without Secure attribute in phpipam/phpipam
Attackers can intercept sensitive session cookies transmitted over unencrypted HTTP connections, leading to potential session hijacking or data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10718?
CVE-2024-10718 is a medium-severity vulnerability in Phpipam Phpipam, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0.
Which versions are affected by CVE-2024-10718?
It affects 1 product.
Products include Phpipam Phpipam.
How do I fix CVE-2024-10718?
No fix has been published for CVE-2024-10718 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-10718 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10718 exists.
Other vulnerabilities in Phpipam Phpipam
Sources
Also known as GHSA-mj67-2mvx-f778.