CVE-2014-0174

Red Hat Enterprise MRG 2.5 - Session Cookie Exposure via Missing HTTPOnly Flag

Title source: llm
STIX 2.1

Description

Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0858.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0859.html

Scores

EPSS 0.0158
EPSS Percentile 72.6%

Details

CWE
CWE-200
Status published
Products (1)
redhat/enterprise_mrg 2.5
Published Jul 11, 2014
Tracked Since Feb 18, 2026