CVE-2019-14849 - 3scale: user session cookie does not set HTTPOnly

Back Back to CVE browser

MEDIUM

3scale: user session cookie does not set HTTPOnly

Published Dec 12, 2019

5.4

MEDIUM

CVSS 3.1

EPSS 0.53%

Description

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.

Affected products

Vendor n/a Product 3scale Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

3scale

n/a

Version	Status	Constraints

3scale API Management 2.6 on RHEL 7

3scale-amp26/3scale-operator:1.9-7

Fixed · RHSA-2019:2534
3scale API Management 2.6 on RHEL 7

3scale-amp26/apicast-gateway:1.15-9

Fixed · RHSA-2019:2534
3scale API Management 2.6 on RHEL 7

3scale-amp26/backend:1.9-24

Fixed · RHSA-2019:2534
3scale API Management 2.6 on RHEL 7

3scale-amp26/operator:1.9-7

Fixed · RHSA-2019:2534
3scale API Management 2.6 on RHEL 7

3scale-amp26/toolbox:1.2-5

Fixed · RHSA-2019:2534
3scale API Management 2.6 on RHEL 7

3scale-amp26/zync:1.9-28

Fixed · RHSA-2019:2534

Product	Package	State	Advisory
3scale API Management 2.6 on RHEL 7	3scale-amp26/3scale-operator:1.9-7	Fixed	RHSA-2019:2534
3scale API Management 2.6 on RHEL 7	3scale-amp26/apicast-gateway:1.15-9	Fixed	RHSA-2019:2534
3scale API Management 2.6 on RHEL 7	3scale-amp26/backend:1.9-24	Fixed	RHSA-2019:2534
3scale API Management 2.6 on RHEL 7	3scale-amp26/operator:1.9-7	Fixed	RHSA-2019:2534
3scale API Management 2.6 on RHEL 7	3scale-amp26/toolbox:1.2-5	Fixed	RHSA-2019:2534
3scale API Management 2.6 on RHEL 7	3scale-amp26/zync:1.9-28	Fixed	RHSA-2019:2534

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-201

CWE-79

Cross-site Scripting (XSS)

References (5)

https://access.redhat.com/security/cve/CVE-2019-14849
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1712167
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14849
https://www.cve.org/CVERecord?id=CVE-2019-14849

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-14849		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1712167		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14849
https://www.cve.org/CVERecord?id=CVE-2019-14849