CVE-2014-0154

oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Score

CVSS 2.0 5.0 Medium

Status

Modified - secalert@redhat.com

Published

2015-02-13

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Ovirt (Ovirt)

References

• http://rhn.redhat.com/errata/RHSA-2015-0158.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1077450