Cleartext data in a session cookie: which kind of vulnerability?

Question

I was running Wireshark while using a website, when I noticed a session cookie storing in cleartext the email address, my first name, my gender and the date of birth I set during the signup process.

In my opinion, it is a vulnerability because it allows an attacker who is sniffing the traffic to retrieve personal data that are useless to manage the session (why do they even need to store my date of birth in a cookie?) and that, in any case, shouldn't be sent in cleartext.

Before sending a report to the website, I would like to be sure about the proper term for this vulnerability. I browsed through the CWE website (http://cwe.mitre.org/), and I think this should either be an example of CWE-315: Cleartext Storage of Sensitive Information in a Cookie or a case of CWE - 319 : Cleartext Transmission of Sensitive Information.

My two (strictly related) questions are:

1. are the information listed above (date of birth, gender, first name, email address) considered sensitive information in the sense of the CWE definitions? The server is located in a EU country, if that helps;
2. If they are indeed sensitive data, is this an example of CWE-315, CWE-319, both, or something else entirely?

Answer 1

1. Yes, this information should be considered sensitive, particularly in the aggregate. E-mail addresses are always PII, and adding date of birth, gender, and first name only makes it even more so.

2. It is definitely an example of CWE-315. It may be an example of CWE-319 as well, if the cookie is ever transmitted over HTTP. If it is only ever transmitted over HTTPS, it is not a CWE-319 issue.

I agree that regardless of whether HTTPS is required or not, this is definitely a issue that you should report them. This is not an acceptable practice, and more so if the cookie is a persistent cookie, and not just an in-memory session cookie.