CWE-1275: Sensitive Cookie with Improper SameSite Attribute

Extended Description

The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).

Code Examples & CVEs

Demonstrative Examples

In this example, a cookie is used to store a session ID for a client's interaction with a website. The snippet of code below establishes a new cookie to hold the sessionID.

Since the sameSite attribute is not specified, the cookie will be sent to the website with each request made by the client. An attacker can potentially perform a CSRF attack by using the following malicious page:

BadJavaScript

let sessionId = generateSessionId()                  let cookieOptions = { domain: 'example.com' }                  response.cookie('sessionid', sessionId, cookieOptions)

In this example, a cookie is used to store a session ID for a client's interaction with a website. The snippet of code below establishes a new cookie to hold the sessionID.

AttackHTML

<html> 		                       <form id=evil action="http://local:3002/setEmail" method="POST"> 		     		      <input type="hidden" name="newEmail" value="abc@example.com" /> 		                         </form> 		                     <script>evil.submit()</script>                   </html>

In this example, a cookie is used to store a session ID for a client's interaction with a website. The snippet of code below establishes a new cookie to hold the sessionID.

GoodJavaScript

let sessionId = generateSessionId()                  let cookieOptions = { domain: 'example.com', sameSite: 'Strict' }                  response.cookie('sessionid', sessionId, cookieOptions)

Observed CVE Examples (1)

CVE-2022-24045

Web application for a room automation system has client-side JavaScript that sets a sensitive cookie without the SameSite security attribute, allowing the cookie to be sniffed

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-1275 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-1275, Sensitive Cookie with Improper SameSite Attribute, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Sensitive Cookie with Improper SameSite Attribute during Implementation

MITRE associates mitigation with Implementation; documented detection approaches include Automated Static Analysis; recorded impacts include Modify Application Data. Use these source-defined anchors to turn CWE-1275 into implementation, review, and verification checks for the affected component.

CWE-1275: Sensitive Cookie with Improper SameSite Attribute — MITRE CWE

Triage CWE-1275 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-1275, Sensitive Cookie with Improper SameSite Attribute, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-1275

Apply MITRE's full root-cause mapping guidance when using CWE-1275, Sensitive Cookie with Improper SameSite Attribute. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-1275 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-1275, Sensitive Cookie with Improper SameSite Attribute. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-1275: Sensitive Cookie with Improper SameSite Attribute?+

CWE-1275: Sensitive Cookie with Improper SameSite Attribute is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The SameSite attribute for sensitive cookies is not set, or an insecure value is used. The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).

What are the security consequences of Sensitive Cookie with Improper SameSite Attribute?+

If exploited, CWE-1275 (Sensitive Cookie with Improper SameSite Attribute) it can compromise Confidentiality, Integrity, Non-Repudiation and Access Control, leading to outcomes such as Modify Application Data.

How do you prevent or mitigate Sensitive Cookie with Improper SameSite Attribute?+

Recommended mitigations for CWE-1275 include: Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.

Which programming languages are affected by Sensitive Cookie with Improper SameSite Attribute?+

CWE-1275 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Sensitive Cookie with Improper SameSite Attribute?+

MITRE documents real CVEs mapped to CWE-1275, including CVE-2022-24045. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-1275 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-1275: Sensitive Cookie with Improper SameSite Attribute

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Likelihood

Mitigation Strategies

Phase

Description

Effectiveness

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (1)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Verify controls for CWE-1275 with SSDF evidence

Address Sensitive Cookie with Improper SameSite Attribute during Implementation

Triage CWE-1275 against known exploitation evidence

Apply precise root-cause mapping to CWE-1275

Validate CWE-1275 with root-cause mapping checks

Frequently Asked Questions

Learn More