VULNERABILITY INTELLIGENCE

CVE-2019-14849

CVSS score5.4 MEDIUM
EPSS probability0.53%
CISA KEVNot currently listed
Published2019-12-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.

Weakness classification

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-201: Insertion of Sensitive Information Into Sent Data

Primary references