Description
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
Potential Impact
Confidentiality
Read Application Data
Demonstrative Examples
Cookie c = new Cookie(ACCOUNT_ID, acctID);response.addCookie(c);Mitigations & Prevention
Always set the secure attribute when the cookie should be sent via HTTPS only.
Detection Methods
- Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2024-47833 | python library for ML and data science does not use the Secure flag for session cookies |
| CVE-2004-0462 | A product does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the product. |
| CVE-2008-3663 | A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie |
| CVE-2008-3662 | A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie |
| CVE-2008-0128 | A product does not set the secure flag for a cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. |
Related Weaknesses
Frequently Asked Questions
What is CWE-614?
CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Variant-level weakness. The Secure attribute for sensitive cookies in HTTPS sessions is not set.
How can CWE-614 be exploited?
Attackers can exploit CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute) to read application data. This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-614?
Key mitigations include: Always set the secure attribute when the cookie should be sent via HTTPS only.
What is the severity of CWE-614?
CWE-614 is classified as a Variant-level weakness (Low-Medium abstraction). It has been observed in 5 real-world CVEs.