CVE-2022-38846: Espocrm

Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days.

EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.

Affected products

• Espocrm Espocrm: version 7.1.8 only

Published 2022-09-16. Last modified 2026-06-17.