GHSA-j224-7qr4-8646HighCVSS 7.5
Centreon Does Not Set HTTPOnly Flag
🔗 CVE IDs covered (1)
📋 Description
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
🎯 Affected products1
- composer/centreon/centreon:<= 19.04.3
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2019-17104
- https://www.openwall.com/lists/oss-security/2019/10/08/1
- https://github.com/centreon/centreon-archived/issues/7097
- https://docs.centreon.com/current/en/administration/secure-platform.html#securing-the-apache-web-server
- https://github.com/advisories/GHSA-j224-7qr4-8646