Description

MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Remediation

References

CVE-2014-8775

Related Vulnerabilities

WordPress Plugin Vertical News Scroller Cross-Site Scripting (1.9)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Directory Traversal (1.7.14.2)

MySQL CVE-2012-0484 Vulnerability (CVE-2012-0484)

WordPress Plugin Blog2Social:Social Media Auto Post & Scheduler Multiple Vulnerabilities (6.9.9)

Chamilo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-39582)

Severity

Medium

Classification

CVE-2014-8775 CWE-200

Tags

Missing Update Known Vulnerabilities