CVE-2015-3983 The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via s...
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedora pacemaker configuration system | <= 0.9.137 | No fix listed |
References
- FEDORA-2015-8761 vendor-advisory
- FEDORA-2015-8788 vendor-advisory
- FEDORA-2015-8765 vendor-advisory
- RHSA-2015:0980 vendor-advisory
- RHSA-2015:0990 vendor-advisory
- 74682 vdb-entry
- bugzilla.redhat.com
- Debian Security Tracker CVE-2015-3983 vendor-advisory