PT-2021-21481 · Adminlte · Adminlte

CVE-2021-3706 · Published 2021-09-15 · Updated 2022-10-25

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions adminlte (affected versions not specified)

Description The issue concerns a sensitive cookie without the 'HttpOnly' flag. This means that the cookie is accessible to JavaScript, potentially allowing an attacker to steal sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-1004

CWE-732

Related Identifiers

CVE-2021-3706

Affected Products

Adminlte

References · 6

• 🔥 https://huntr.dev/bounties/ac7fd77b-b31b-4d02-aebd-f89ecbae3fce · Exploit
• https://github.com/pi-hole/adminlte/commit/cf8602eedd4a31eadb72372fc878c12d342f8600 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3706 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3706 · Vendor Advisory
• https://t.me/cvenotify/20886 · Telegram Post
• https://t.me/cvenotify/20867 · Telegram Post