Session Cookie Vulnerability in MFScripts YetiShare by MFScripts
CVE-2019-19736

6.1MEDIUM

Key Information:

Vendor

Mfscripts

Status
Yetishare
Vendor
CVE Published:
30 December 2019

What is CVE-2019-19736?

MFScripts YetiShare, specifically versions 3.5.2 through 4.5.3, exhibits a security vulnerability due to the lack of HttpOnly flag on session cookies. This oversight allows malicious scripts to access session cookies, leading to a potential cross-site scripting (XSS) attack. Attackers can exploit this vulnerability to read the cookies, compromising user session data. It is essential for users and administrators of YetiShare to update to secure versions and implement proper security configurations.

References

https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multi...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.