Cross site scripting

2019-12-3017:15:00

PRIOn knowledge base

www.prio-n.com

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be used by attackers to obtain the cookie via cross-site scripting.

CPENameOperatorVersion
yetisharege3.5.2
yetisharele4.5.3

CPE	Name	Operator	Version
	yetishare	ge	3.5.2
	yetishare	le	4.5.3

References

medium.com/@jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459