CWE-565 Reliance on Cookies without Validation and Integrity Checking
Description
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-565 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-grh8-3p95-f9rr | CVE-2026-69215 | MODERATE |
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
2026-09-15 | |
| GHSA-wv64-j4fq-5f9x | CVE-2026-69214 | MODERATE |
Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain |
2026-09-15 | |
| GHSA-8c7c-h7px-267g | CVE-2026-8337 | MODERATE | - |
Concrete CMS is vulnerable to IDOR in surveys |
2026-06-24 |
| GHSA-33qg-7wpp-89cq | CVE-2026-39324 | CRITICAL |
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization |
2026-05-13 | |
| GHSA-4m6c-649p-f6gf | CVE-2026-39963 | MODERATE | - |
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php |
2026-04-15 |
| GHSA-8pgc-65mj-53h5 | CVE-2024-21583 | MODERATE |
github.com/gitpod-io/gitpod vulnerable to Cookie Tossing |
2024-10-31 | |
| GHSA-7r3h-4ph8-w38g | CVE-2024-28233 | HIGH |
Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing |
2024-03-28 | |
| GHSA-j224-7qr4-8646 | CVE-2019-17104 | HIGH | - |
Centreon Does Not Set HTTPOnly Flag |
2023-09-25 |
| GHSA-4vf4-qmvg-mh7h | CVE-2021-41819 | HIGH |
Cookie Prefix Spoofing in CGI::Cookie.parse |
2023-08-29 | |
| GHSA-w3w9-vrf5-8mx8 | CVE-2022-36032 | MODERATE | - |
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent |
2022-09-16 |
| GHSA-844m-cpr9-jcmh | CVE-2021-41263 | MODERATE |
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application |
2022-08-11 | |
| GHSA-cwmx-hcrq-mhc3 | CVE-2022-29248 | HIGH | - |
Cross-domain cookie leakage in Guzzle |
2022-06-20 |
| GHSA-cg3q-59w7-rvc2 | CVE-2021-3818 | MODERATE | - |
Reliance on Cookies without Validation and Integrity Checking in getgrav/grav |
2021-09-28 |
| GHSA-rc4q-9m69-gqp8 | CVE-2021-29624 | MODERATE |
Lack of protection against cookie tossing attacks in fastify-csrf |
2021-05-17 | |
| GHSA-55mm-5399-7r63 | CVE-2020-15128 | MODERATE | - |
Reliance on Cookies without validation in OctoberCMS |
2021-03-04 |