Insecure Cookies

2019-01-1509:05:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

74.7%

JSON

noVNC did not provide support for secure cookies in an HTTPS session. This causes browsers to send session cookies in an insecure HTTP channel. An attacker who is able to intercept traffic will be able to capture cookie information and access the application on behalf of the user.

CPENameOperatorVersion
novnceq0.4__7.el6ev
novnceq0.3__10.el6
novnceq0.4__6.el6ost
novnceq0.4__8.el6ost
novnceq0.4__2.el6
novnceq0.4__7.el7ost
novnceq0.4__4.el6ost
novnceq0.4__3.el6ost
novnceq0.4__8.1.el6

Name	Operator	Version
novnc	eq	0.4__7.el6ev
novnc	eq	0.3__10.el6
novnc	eq	0.4__6.el6ost
novnc	eq	0.4__8.el6ost
novnc	eq	0.4__2.el6
novnc	eq	0.4__7.el7ost
novnc	eq	0.4__4.el6ost
novnc	eq	0.4__3.el6ost
novnc	eq	0.4__8.1.el6