CWE-1275: Sensitive Cookie with Improper SameSite Attribute

VariantIncompleteExploit Likelihood: Medium

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

View on MITRE
Back to CWE Lookup

Extended Description

The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).

Technical Details

Structure
Simple

Applicable To

Languages
Not Language-Specific
Platforms
Not OS-Specific

Learn More

Find Related CVEs

Search for vulnerabilities that exploit CWE-1275

CVE vs CWE: What's the Difference?

Understanding vulnerabilities vs weaknesses

Understanding CVSS Scoring

How vulnerability severity is measured

View Full MITRE Entry

Complete technical details and references