NVD

Id
7024  
Name
CVE-2008-7298  
Description
The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-03  
Published
2011-08-09  
Modified Date
2012-08-02  
Seq
2008-7298  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
39570 7024 CVE-2008-7298 http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookies  View
39571 7024 CVE-2008-7298 http://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.html  View
39572 7024 CVE-2008-7298 http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.html  View
39573 7024 CVE-2008-7298 http://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.html  View
39574 7024 CVE-2008-7298 https://bugzilla.mozilla.org/show_bug.cgi?id=660053  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
33554 JVNDB-2011-003796 Android の Android ブラウザにおける任意クッキーが上書きまたは削除される脆弱性 Android の Android ブラウザには、HTTPS セッションが確立したクッキーに変更制限ができないため、任意クッキーが上書きまたは削除される脆弱性が存在します。 CVE-2008-7298 37411 CVE-2008-7298 7024 5.8 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-003796.html 2011-08-09 2012-03-27 View