CVE-2024-44575
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The vulnerability in RELY-PCIe versions v22.2.1 to v23.1.0 fails to set the Secure attribute for sensitive cookies in HTTPS sessions. This could cause the user agent to send those cookies in cleartext over an unencrypted HTTP session.
Risk Assessment
The risk involves potential interception of sensitive authentication or session data by an attacker during transmission over an unencrypted HTTP connection, which could lead to unauthorized system access.
Recommendation
Immediately upgrade RELY-PCIe to a version later than v23.1.0 that includes a fix enforcing the Secure attribute for all sensitive cookies in HTTPS sessions.
Other vulnerabilities in RELY-PCIe
See all- CVE-2024-44577High
A command injection vulnerability was discovered in RELY-PCIe versions v22.2.1 to v23.1.0. The flaw resides in the time_date function.
- CVE-2024-44574High
A command injection vulnerability was discovered in RELY-PCIe versions v22.2.1 to v23.1.0 via the sys_conf function. An attacker can remotely execute arbitrary system commands.
- CVE-2024-44573Medium
A stored cross-site scripting (XSS) vulnerability in the VLAN configuration of RELY-PCIe versions v22.2.1 to v23.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2024-44572High
A command injection vulnerability was discovered in RELY-PCIe versions v22.2.1 to v23.1.0 within the sys_mgmt function. An attacker can remotely execute arbitrary system commands.
- CVE-2024-44571High
Incorrect access control was discovered in the mService function at phpinf.php in RELY-PCIe versions v22.2.1 to v23.1.0. This vulnerability may allow an unauthorized user to perform unwanted operations.
- CVE-2024-44570High
A code injection vulnerability was discovered in RELY-PCIe versions v22.2.1 to v23.1.0 via the getParams function in phpinf.php. An attacker can remotely execute arbitrary code, leading to full system compromise.
Original NVD description (English source)
RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS