In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0.
References
| Link | Resource |
|---|---|
| https://github.com/phpipam/phpipam/commit/ddf70ef6801442eb8b0be5eea829e470e653c70e | Patch |
| https://huntr.com/bounties/725bce8f-328f-4fbc-acf5-46ea920cd3c1 | Exploit Third Party Advisory |
Configurations
History
27 Jun 2025, 15:29
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Phpipam phpipam
Phpipam |
|
| CPE | cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/725bce8f-328f-4fbc-acf5-46ea920cd3c1 - Exploit, Third Party Advisory | |
| References | () https://github.com/phpipam/phpipam/commit/ddf70ef6801442eb8b0be5eea829e470e653c70e - Patch | |
| CWE | CWE-319 |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-06-27 15:29
NVD link : CVE-2024-10718
Mitre link : CVE-2024-10718
JSON object : View
Products Affected
phpipam
- phpipam