CVE-2019-8283
07.06.2019, 15:29
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gemalto | sentinel_ldk | 𝑥 < 7.92 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-1004 - Sensitive Cookie Without 'HttpOnly' FlagThe software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
- CWE-732 - Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.