PT-2020-16092 · Simplephpscripts · Simplephpscripts News Script Php Pro

Published 2020-11-24 · Updated 2020-11-30 · CVE-2020-25473

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SimplePHPscripts News Script PHP Pro version 2.3

Description The issue is related to the improper setting of the HttpOnly Flag from Session Cookies. This could potentially allow unauthorized access to session cookies.

Recommendations For SimplePHPscripts News Script PHP Pro version 2.3, consider updating the session cookie settings to include the HttpOnly Flag to prevent JavaScript access. As a temporary workaround, restrict access to session cookies until a proper fix is applied.

Fix

Related Identifiers

CVE-2020-25473

Affected Products

Simplephpscripts News Script Php Pro

References · 7

• https://osv.dev/vulnerability/CVE-2020-25473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25473 · Security Note
• https://t.me/cvenotify/6112 · Telegram Post
• https://t.me/cibsecurity/16780 · Telegram Post
• https://news.websec.nl · Note
• https://linkedin.com/feed/update/urn:li:activity:6736997788850122752 · Note
• https://websec.nl · Note