PT-2014-3517 · Red Hat · Red Hat Enterprise Mrg

Publicado

2014-07-11

·

Atualizado

2021-07-15

·

CVE-2014-0174

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Red Hat Enterprise MRG 2.5
Description The issue allows remote attackers to obtain potentially sensitive information via script access to a session cookie. This is because the HTTPOnly flag is not included in the Set-Cookie header for the session cookie.
Recommendations For Red Hat Enterprise MRG 2.5, consider configuring the application to include the HTTPOnly flag in the Set-Cookie header for the session cookie to prevent script access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-0174
RHSA-2014:0858
RHSA-2014:0859

Produtos afetados

Red Hat Enterprise Mrg