Sensitive Cookie Without 'HttpOnly' Flag
CVE-2025-12031
Summary
HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- LOW
- NONE
CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag
The software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
References
Advisory Timeline
- Published
