CVE-2019-14849

MEDIUM

Redhat 3scale < 2.6 - XSS

Title source: rule

Description

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.

References (1)

[Issue Tracking, Vendor Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849

Scores

CVSS v3 5.4

EPSS 0.0037

EPSS Percentile 58.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-201 CWE-79

Status published

Affected Products (1)

redhat/3scale < 2.6

Timeline

Published Dec 12, 2019

Tracked Since Feb 18, 2026