Описание
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
Ссылки
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:hcltech:hcl_sx:21:*:*:*:*:*:*:*
EPSS
Процентиль: 16%
0.00051
Низкий
5.5 Medium
CVSS3
4.3 Medium
CVSS3
Дефекты
CWE-1275
Связанные уязвимости
CVSS3: 5.5
github
11 месяцев назад
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
EPSS
Процентиль: 16%
0.00051
Низкий
5.5 Medium
CVSS3
4.3 Medium
CVSS3
Дефекты
CWE-1275