CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

VariantLikelihood of exploit: Medium

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Consequences

Confidentiality: Read Application Data
Integrity: Gain Privileges or Assume Identity

How to prevent it

Implementation: Leverage the HttpOnly flag when setting a sensitive cookie in a response.

Recent advisories

GHSA-494j-54xm-rwp3 — AIOHTTP: Secure attribute not enforced for shared cookie
GHSA-f777-f784-36gm — TYPO3 Security Misconfiguration in Install Tool Cookie
GHSA-ppvg-hw62-6ph9 — TYPO3 Security Misconfiguration in Install Tool Cookie
GHSA-pvjh-7h8q-q56r — Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header

All advisories for CWE-1004

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor