High severity · published Mar 20, 2025
CVE-2024-10718
Cookie without Secure attribute in phpipam/phpipam
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
phpipam/phpipam · phpipam
before 1.7.0 · source: vendor
PH
Phpipam · Phpipam
before 1.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10718
Patch
https://github.com/phpipam/phpipam/commit/ddf70ef6801442eb8b0be5eea829e470e653c70e
Exploit
https://huntr.com/bounties/725bce8f-328f-4fbc-acf5-46ea920cd3c1
More from phpipam/phpipam
6.1
CVE-2024-10727
Cross-Site Scripting (XSS) in phpipam/phpipam
6.1
CVE-2024-10720
Stored Cross-site Scripting (XSS) in phpipam/phpipam
5.9
CVE-2024-0787
Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam
5.4
CVE-2024-10721
Store XSS in phpipam/phpipam
5.4
CVE-2024-10722
Stored Cross-site Scripting (XSS) in phpipam/phpipam