CVE-2014-0174

Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Score

CVSS 2.0 4.3 Medium

Status

Modified - secalert@redhat.com

Published

2014-07-11

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Enterprise Mrg (Redhat)

References

• http://rhn.redhat.com/errata/RHSA-2014-0858.html
• http://rhn.redhat.com/errata/RHSA-2014-0859.html