{"api_version":"1","generated_at":"2026-07-24T01:39:28+00:00","cve":"CVE-2009-3584","urls":{"html":"https://cve.report/CVE-2009-3584","api":"https://cve.report/api/cve/CVE-2009-3584.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-3584","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-3584"},"summary":{"title":"CVE-2009-3584","description":"SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-12-23 18:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-16","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/37877","name":"http://secunia.com/advisories/37877","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"SQL-Ledger Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/508559/100/0/threaded","name":"http://www.securityfocus.com/archive/1/508559/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54968","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54968","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/37431","name":"http://www.securityfocus.com/bid/37431","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SQL-Ledger Multiple Remote Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3584","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3584","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"3584","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sql-ledger","cpe5":"sql-ledger","cpe6":"2.8.24","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T06:31:10.543Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20091221 SQL-Ledger â?? several vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/508559/100/0/threaded"},{"name":"37877","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/37877"},{"name":"37431","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/37431"},{"name":"sqlledger-cookie-weak-security(54968)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54968"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-12-21T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-10T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20091221 SQL-Ledger â?? several vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/508559/100/0/threaded"},{"name":"37877","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/37877"},{"name":"37431","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/37431"},{"name":"sqlledger-cookie-weak-security(54968)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54968"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-3584","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20091221 SQL-Ledger â?? several vulnerabilities","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/508559/100/0/threaded"},{"name":"37877","refsource":"SECUNIA","url":"http://secunia.com/advisories/37877"},{"name":"37431","refsource":"BID","url":"http://www.securityfocus.com/bid/37431"},{"name":"sqlledger-cookie-weak-security(54968)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54968"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-3584","datePublished":"2009-12-23T18:00:00.000Z","dateReserved":"2009-10-07T00:00:00.000Z","dateUpdated":"2024-08-07T06:31:10.543Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-12-23 18:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-16","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sql-ledger:sql-ledger:2.8.24:*:*:*:*:*:*:*","matchCriteriaId":"E37F91C4-5164-4428-82B6-10DAFC0C3FAD"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"3584","Ordinal":"1","Title":"CVE-2009-3584","CVE":"CVE-2009-3584","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"3584","Ordinal":"1","NoteData":"SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.","Type":"Description","Title":"CVE-2009-3584"},{"CveYear":"2009","CveId":"3584","Ordinal":"2","NoteData":"2009-12-23","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"3584","Ordinal":"3","NoteData":"2018-10-10","Type":"Other","Title":"Modified"}]}}}