CVE-2008-4122

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://int21.de/cve/CVE-2008-4122-joomla.htmlThird Party Advisory
http://securityreason.com/securityalert/4794Third Party Advisory
http://www.securityfocus.com/archive/1/499295/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/499354/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://int21.de/cve/CVE-2008-4122-joomla.htmlThird Party Advisory
http://securityreason.com/securityalert/4794Third Party Advisory
http://www.securityfocus.com/archive/1/499295/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/499354/100/0/threadedBroken Link, Third Party Advisory, VDB Entry

Timeline

Published: Dec 19, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-41255.0The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain pote CVE-2008-41266.4PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transact CVE-2008-41274.3Mshtml.dll in Microsoft Internet Explorer 7 Gold 7.0.5730 and 8 Beta 8.0.6001 on Windows XP SP2 allows remote attackers to cause a denial of CVE-2008-41288.1Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Serv CVE-2008-41294.0Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticat CVE-2008-41304.3Cross-site scripting (XSS) vulnerability in Gallery 2.x before 2.2.6 allows remote attackers to inject arbitrary web script or HTML via a cr CVE-2008-41317.2Multiple unspecified vulnerabilities in Sun Solaris 8 through 10 allow local users to gain privileges via vectors related to handling of tag CVE-2008-41329.3Stack-based buffer overflow in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne VSFlexGrid 7.0.1.151 and 8.0.20072.239 allows remo CVE-2008-41334.3The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allo CVE-2008-41347.5PHP remote file inclusion vulnerability in manager/static/view.php in phpRealty 0.03 and earlier, and possibly other versions before 0.05, a CVE-2008-41357.8Symbian OS S60 3rd edition on the Nokia E90 Communicator 07.40.1.2 Ra-6 and Nseries N82 allows remote attackers to cause a denial of service CVE-2008-41365.0Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash) via multiple RETR