CVE-2016-6344

MEDIUM

Red Hat JBoss BPM Suite 6.3.x - Info Disclosure

Title source: llm

Description

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.

References (4)

Scores

CVSS v3 5.3
EPSS 0.0032
EPSS Percentile 54.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Classification

CWE
CWE-200
Status published

Affected Products (2)

redhat/jboss_bpm_suite
n/a/n/a

Timeline

Published Sep 07, 2016
Tracked Since Feb 18, 2026