Design/Logic Flaw

2014-07-0210:35:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.2%

JSON

pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CPENameOperatorVersion
pfsensele2.1.3

CPE	Name	Operator	Version
	pfsense	le	2.1.3

References

pfsense.org/security/advisories/pfSense-SA-14_12.webgui.asc