CVEvulnerability

CVE-2019-14849

5.4 MEDIUM Published 2019-12-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-12-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0 ([email protected])
4.6 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-201, CWE-79

Description

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.

Affected configurations

• redhat 3scale (< 2.6)

Related

Weakness · CWE (2)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References