Skip to main content

Sensitive Cookie Without 'HttpOnly' Flag

CVE-2021-34563

Low
3.3/10

Summary

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag

The software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

References

Advisory Timeline

  • Published