Security Flaw in SmarterStats 6.0 Web Server by SmarterTools

CVE-2011-2154

What is CVE-2011-2154?

The SmarterStats 6.0 web server is susceptible to a vulnerability where the loginsettings cookie lacks the HTTPOnly flag in its Set-Cookie header. This oversight allows remote attackers to exploit the situation by potentially accessing sensitive information stored in the cookie through scripting techniques. By not enabling the HTTPOnly attribute, the cookie can be compromised, leading to unauthorized data exposure and posing risks to user privacy and security.

References