CoreCVE
Back

MEDIUM

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be used by attackers to obtain the cookie via cross-site scripting

Published Dec 30, 2019

Description

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be used by attackers to obtain the cookie via cross-site scripting.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 30, 2019
Updated Aug 5, 2024
Reserved Dec 11, 2019
Link CVE-2019-19736
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-19736
Red Hat
Severity n/a
Public date n/a
Links CVE-2019-19736