Skip to main content

Sensitive Cookie Without 'HttpOnly' Flag

CVE-2025-24318

Medium
5.9/10

Summary

Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise.

  • HIGH
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag

The software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

References

Advisory Timeline

  • Published