CVE-2019-14849

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-14849
A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:3scale:*:*:*:*:*:*:*:*
History

12 Feb 2023, 23:35

Type Values Removed Values Added
Summary A flaw was found where 3scale did not set the HTTPOnly attribute on the user session cookie. An attacker could abuse this flaw to conduct Cross-site Scripting attacks and gain access to unauthorized information. A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.
CWE CWE-79 CWE-201
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2019-14849', 'name': 'https://access.redhat.com/security/cve/CVE-2019-14849', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1712167', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1712167', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2019:2534', 'name': 'https://access.redhat.com/errata/RHSA-2019:2534', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:18

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2019-14849 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1712167 -
  • (MISC) https://access.redhat.com/errata/RHSA-2019:2534 -
Summary A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information. A flaw was found where 3scale did not set the HTTPOnly attribute on the user session cookie. An attacker could abuse this flaw to conduct Cross-site Scripting attacks and gain access to unauthorized information.
Information

Published : 2019-12-12 14:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-14849

Mitre link : CVE-2019-14849

CVE.ORG link : CVE-2019-14849

JSON object : View

Products Affected

redhat

  • 3scale
CWE
CWE-201

Insertion of Sensitive Information Into Sent Data

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')