Use of Persistent Cookies Containing Sensitive Information
CWE-539
The web application uses persistent cookies, but the cookies contain sensitive information.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: Do not store sensitive information in persistent cookies.
Latest Use of Persistent Cookies Containing Sensitive Information vulnerabilities
- 9.1 Critical severity
Vasion Print: Use of Persistent Cookies Containing Sensitive Information
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OVE-20230524-0017.
- 8.8 High severity
ADAM-5630: Use of Persistent Cookies Containing Sensitive Information
Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if the session was terminated, allows an unauthorized attacker to act with the same level of privileges
- 7.5 High severity
flask: Use of Persistent Cookies Containing Sensitive Information
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` hea