Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

Variant Incomplete

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

How to prevent it (1 mitigation)

  1. Implementation

    Leverage the HttpOnly flag when setting a sensitive cookie in a response.

Source: MITRE CWE-1004

All Critical High Medium Low Exploited only Public exploit

51 results · Feed

  • Low 3.7
    CVE-2019-25091

    nsupdate.info CSRF Cookie base.py cookie httponly flag

    A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRF_COOKIE_HTTPONLY leads to cookie witho…

    nsupdate PyPI
  • Medium 5.3
    CVE-2022-4630

    Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius

    Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.

    lirantal lirantal/daloradius
  • High 7.5
    CVE-2022-25172

    An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InR…

    InHand Networks InRouter302
  • High 8.1
    CVE-2021-42115

    Missing HTTPOnly flag on sensitive cookie in TopEase

    Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the…

    Business-DNA Solutions TopEase
  • Medium 6.5
    CVE-2021-39210

    Autologin cookie accessible by scripts

    GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be …

    GLPI glpi glpi Ubuntu
  • High 7.4
    CVE-2021-3706

    Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte

    adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag

    pi-hole pi-hole/adminlte
  • Low 3.3
    CVE-2021-34563

    In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify it

    In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.

    Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP WHA-GW-F2D2-0-AS- Z2-ETH ICS / OT
  • High 7.1
    CVE-2020-27658

    Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the sessi…

    Synology Synology Router Manager (SRM)
  • Medium 6.3
    CVE-2020-6267

    Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cook…

    SAP SAP Disclosure Management
  • Unscored —
    CVE-2019-8283

    Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows m…

  • Medium —
    CVE-2010-4312

    Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header

    The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.

    org.apache.tomcat:tomcat Maven