HTTPOnly Flag Absence in pcsd Affects Red Hat and Fedora Products
CVE-2015-3983
Currently unrated
What is CVE-2015-3983?
The pcs daemon (pcsd) prior to version 0.9.137 lacks the HTTPOnly flag in its Set-Cookie header. This oversight allows remote attackers to exploit the absence of this security measure to gain access to sensitive information through script access to cookies. Without the HTTPOnly attribute, cookies may be exposed to cross-site scripting (XSS) attacks, facilitating unauthorized data retrieval and posing security risks for users.