CVE-2023-3520

MediumCVSS 4.6

Published: 06/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

In the GitHub repository it-novum/openitcockpit prior to version 4.6.6, there is a vulnerability related to sensitive cookies in HTTPS sessions that lack the 'Secure' attribute.

Risk Assessment

The absence of the 'Secure' attribute in cookies may allow attackers to intercept them, posing a risk of exposing sensitive user information.

Recommendation

It is recommended to upgrade to version 4.6.6 or later and ensure that all sensitive cookies have the 'Secure' attribute set.

Original NVD description (English source)

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.