Common Weakness Enumeration
CWE-1004
AllowedSensitive Cookie Without 'HttpOnly' Flag
Abstraction: Variant · Status: Incomplete
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
71 vulnerabilities reference this CWE, most recent first.
GHSA-XXWW-73XW-X3FJ
Vulnerability from github – Published: 2023-06-13 06:30 – Updated: 2024-04-04 04:45
VLAI
Details
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-2876"
],
"database_specific": {
"cwe_ids": [
"CWE-1004",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-13T04:15:10Z",
"severity": "MODERATE"
},
"details": "Sensitive Cookie Without \u0027HttpOnly\u0027 Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1.\n\n",
"id": "GHSA-xxww-73xw-x3fj",
"modified": "2024-04-04T04:45:06Z",
"published": "2023-06-13T06:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2876"
},
{
"type": "WEB",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=2NGA001423\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
Leverage the HttpOnly flag when setting a sensitive cookie in a response.
No CAPEC attack patterns related to this CWE.