PT-2015-6371 · Pcs+2 · Pcs+2

Published 2015-05-12 · Updated 2016-12-31 · CVE-2015-3983

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PCS versions 0.9.137 and earlier

Description The issue allows remote attackers to obtain potentially sensitive information via script access to a cookie, as the HTTPOnly flag is not included in a Set-Cookie header.

Recommendations For versions 0.9.137 and earlier, consider configuring the pcs daemon (pcsd) to include the HTTPOnly flag in Set-Cookie headers to prevent unauthorized script access to sensitive cookies.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CESA-2015_0980

CVE-2015-3983

RHSA-2015:0980

RHSA-2015:0990

RHSA-2015_0980

RHSA-2015_0990

Affected Products

Centos

Pcs

Red Hat

References · 19

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3983 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0980.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1848 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-3983 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0990.html · Vendor Advisory
• https://lists.centos.org/pipermail/centos-announce/2015-May/058045.html · Note
• https://bugzilla.redhat.com/attachment.cgi?id=1009855 · Note
• https://access.redhat.com/security/cve/CVE-2015-3983 · Note
• https://access.redhat.com/errata/RHSA-2015:0980 · Note
• https://access.redhat.com/security/cve/CVE-2015-1848 · Note
• https://lists.centos.org/pipermail/centos-announce/2015-May/070601.html · Note
• https://lists.centos.org/pipermail/centos-announce/2015-May/033164.html · Note