Cyber Posture

CVE-2024-10718

HighPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
27 June 2025
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0008 22.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.

Security Summary

CVE-2024-10718 is a vulnerability in phpipam/phpipam version 1.5.1, an open-source IP address management application. The issue arises because the Secure attribute is not set on sensitive cookies during HTTPS sessions, which can lead user agents to transmit those cookies in plaintext over HTTP connections, potentially exposing sensitive information. This flaw corresponds to CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute) and CWE-319 (Cleartext Transmission of Sensitive Information), with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

The vulnerability can be exploited by any network attacker with low complexity and no privileges or user interaction required. An adversary positioned to observe traffic could capture sensitive cookies if a victim's browser downgrades to an HTTP session, such as through interception on unsecured networks. Successful exploitation enables high-impact confidentiality violations by disclosing cookie contents, which may include session tokens or other sensitive data.

Mitigation is provided in phpipam/phpipam version 1.7.0, where the Secure attribute is properly implemented, as detailed in the fix commit at https://github.com/phpipam/phpipam/commit/ddf70ef6801442eb8b0be5eea829e470e653c70e. Security practitioners should upgrade affected installations to version 1.7.0 or later. Further details are available in the Huntr.dev bounty report at https://huntr.com/bounties/725bce8f-328f-4fbc-acf5-46ea920cd3c1.

Details

CWE(s)
CWE-614CWE-319

Affected Products

phpipam
phpipam
≤ 1.7.0

MITRE ATT&CK Enterprise Techniques

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Why these techniques?

Vulnerability causes sensitive cookies to be sent over plaintext HTTP, enabling network sniffing (T1040), web session cookie theft (T1539), and adversary-in-the-middle attacks (T1557).

References