Weakness (CWE)
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
Variant Incomplete
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
How to prevent it (1 mitigation)
-
Implementation
Leverage the HttpOnly flag when setting a sensitive cookie in a response.
Source: MITRE CWE-1004
1 result · Clear filters · Feed
-
Critical 9.8
An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.