WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.022
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
WebDyne, a Perl framework for building web applications, is affected because its session module issues session cookies without the Secure, HttpOnly, or SameSite protections. This lets attackers on the network or injected scripts steal a user's session, and lets other websites make requests that carry that session.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- WebDyne
From 2.014 · fixed in 3.022