CVE-2014-4692

pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Configurations

Configuration 1 (hide)

cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2014-07-02 10:35

Updated : 2024-02-04 18:35


NVD link : CVE-2014-4692

Mitre link : CVE-2014-4692

CVE.ORG link : CVE-2014-4692


JSON object : View

Products Affected

netgate

  • pfsense
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor