PT-2014-3517 · Red Hat · Red Hat Enterprise Mrg

Published 2014-07-11 · Updated 2021-07-15 · CVE-2014-0174

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise MRG 2.5

Description The issue allows remote attackers to obtain potentially sensitive information via script access to a session cookie. This is because the HTTPOnly flag is not included in the Set-Cookie header for the session cookie.

Recommendations For Red Hat Enterprise MRG 2.5, consider configuring the application to include the HTTPOnly flag in the Set-Cookie header for the session cookie to prevent script access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-0174

RHSA-2014:0858

RHSA-2014:0859

Affected Products

Red Hat Enterprise Mrg

References · 3

• http://rhn.redhat.com/errata/RHSA-2014-0858.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0174 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0859.html · Vendor Advisory