Cookie Misconfiguration in PhpIPAM Vulnerable to Information Exposure
CVE-2024-10718

5.3MEDIUM

Key Information:

Vendor

PHPipam

Status
PHPipam/PHPipam
Vendor
CVE Published:
20 March 2025

What is CVE-2024-10718?

In PhpIPAM version 1.5.1, sensitive cookies lack the Secure attribute during HTTPS sessions. This oversight allows user agents to transmit these cookies in plaintext over unsecured HTTP sessions, potentially leading to sensitive information exposure. The vulnerability is addressed in version 1.7.0, which ensures that secure attributes are appropriately set for sensitive cookies, thereby enhancing the security of user data.

Affected Version(s)

phpipam/phpipam < 1.7.0

References

https://huntr.com/bounties/725bce8f-328f-4fbc-acf5-46ea92...
https://github.com/phpipam/phpipam/commit/ddf70ef6801442e...

CVSS V3.0

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.