CVE-2013-4617

Jahia xCM < 6.6.1 - Unauthenticated Sensitive Information Exposure via JSESSIONID Cookie

Title source: llm
STIX 2.1

Description

Jahia xCM before 6.6.2 does not include the HTTPOnly flag in a Set-Cookie header for the JSESSIONID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

References (1)

Core 1

Scores

EPSS 0.0126
EPSS Percentile 66.0%

Details

CWE
CWE-200
Status published
Products (1)
jahia/jahia_xcm < 6.6.1
Published Nov 27, 2013
Tracked Since Feb 18, 2026