Cross site scripting

2019-06-0720:29:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.5%

JSON

An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie “Password508” does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily.

CPENameOperatorVersion
awk-3121_firmwareeq1.14

CPE	Name	Operator	Version
	awk-3121_firmware	eq	1.14

References

packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html

github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121

seclists.org/bugtraq/2019/Jun/8