CVE-2015-3319

2015-04-1614:00:00

mitre

www.cve.org

6.1 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

72.9%

JSON

Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

References

packetstormsecurity.com/files/131297/HotExBilling-Manager-73-Cross-Site-Scripting.html

seclists.org/fulldisclosure/2015/Apr/18

www.securityfocus.com/archive/1/535186/100/0/threaded

www.securityfocus.com/bid/74205