Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qMjI0LTdxcjQtODY0Ns4AAiSV

Centreon Does Not Set HTTPOnly Flag

In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.

Permalink: https://github.com/advisories/GHSA-j224-7qr4-8646
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qMjI0LTdxcjQtODY0Ns4AAiSV
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-j224-7qr4-8646, CVE-2019-17104
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-17104
• https://www.openwall.com/lists/oss-security/2019/10/08/1
• https://github.com/centreon/centreon-archived/issues/7097
• https://docs.centreon.com/current/en/administration/secure-platform.html#securing-the-apache-web-server
• https://github.com/advisories/GHSA-j224-7qr4-8646

Repository: https://github.com/centreon/centreon-archived
Blast Radius: 3.6

Affected Packages