Language: PHP
Label: vulnerable
CWE: CWE-614 \u2014 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Code:
    public static function setCookie($key, $value, $time = 3600, $path = '/', $http_only = true, $domain = '') {

        $cookie_domain = cmsConfig::get('cookie_domain');

        if (!$domain && $cookie_domain) {
            $domain = $cookie_domain;
        }

        if (PHP_VERSION_ID < 70300) {
            return setcookie('icms[' . $key . ']', $value, time() + $time, $path, $domain, false, $http_only);
        } else {
            return setcookie('icms[' . $key . ']', $value, [
                'expires'  => time() + $time,
                'path'     => $path,
                'domain'   => $domain,
                'samesite' => 'Lax',
                'secure'   => false,
                'httponly' => $http_only
            ]);
        }
    }