CVE-2008-2558

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-06-05 · updated 2026-06-16
Weakness: CWE-310

Description

CRE Loaded 6.2.13.1 and earlier does not set the "Secure" attribute for cookies that are sent over HTTPS, which might allow remote attackers to sniff the cookies if they are sent over HTTP.

Affected products

Cre Loaded: through 6.2.13.1

References

http://oscommerceuniversity.com/lounge/index.php?topic=255.0
https://exchange.xforce.ibmcloud.com/vulnerabilities/42889
http://oscommerceuniversity.com/lounge/index.php?topic=255.0
https://exchange.xforce.ibmcloud.com/vulnerabilities/42889

Get alerted when CVE-2008-2558 or the next vulnerability affects your stack