NetSight
IP …
medium5.8

CVE-2008-7294

Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to ove…

Impact

Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.

Affected products

VendorProductAffected versions
GoogleChrome
through 3.0.195.38
Versions 0.1.38.1, 0.1.38.2, 0.1.38.4, 0.1.40.1, 0.1.42.2

Weakness classification

CWE-264

References