Session Cookie Vulnerability in Seagate NAS OS Web Application
CVE-2018-12302

6.1MEDIUM

Key Information:

Vendor

Seagate

Status
Nas Os
Vendor
CVE Published:
13 May 2019

What is CVE-2018-12302?

The Seagate NAS OS version 4.3.15.1 web application has a vulnerability due to the absence of the HTTPOnly flag on session cookies. This oversight enables malicious actors to exploit cross-site scripting attacks, potentially stealing session tokens and compromising user accounts. Security measures should be enhanced to prevent unauthorized access and safeguard user information.

References

https://blog.securityevaluators.com/invading-your-persona...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.