CWE-614 HTTPS会话中未设置’Secure’属性的敏感Cookie 类漏洞列表 63

CWE-614 HTTPS会话中未设置’Secure’属性的敏感Cookie 类弱点 63 条 CVE 漏洞汇总，含 AI 中文分析。

常见影响 (1)

Confidentiality Read Application Data

Omitting the secure flag makes it possible for the user agent to send the cookies in plaintext over an HTTP session.

缓解措施 (1)

Implementation Always set the secure attribute when the cookie should be sent via HTTPS only.

代码示例 (1)

The snippet of code below, taken from a servlet doPost() method, sets an accountID cookie (sensitive) without calling setSecure(true).

Cookie c = new Cookie(ACCOUNT_ID, acctID); response.addCookie(c);

Bad · Java