PT-2015-6147 · Hotspot Express · Hotspot Express Hotex Billing Manager

Publicado 2015-04-16 · Atualizado 2018-10-09 · CVE-2015-3319

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hotspot Express hotEx Billing Manager version 73

Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to a cookie, as the HTTPOnly flag is not included in a Set-Cookie header.

Recommendations For Hotspot Express hotEx Billing Manager version 73, consider configuring the application to include the HTTPOnly flag in Set-Cookie headers to mitigate the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-3319

Produtos afetados

Hotspot Express Hotex Billing Manager

Referências · 5

• http://packetstormsecurity.com/files/131297/HotExBilling-Manager-73-Cross-Site-Scripting.html · Nota
• http://securityfocus.com/archive/1/535186/100/0/threaded · Nota
• http://seclists.org/fulldisclosure/2015/Apr/18 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3319 · Nota de Segurança
• http://securityfocus.com/bid/74205 · Nota