Information disclosure in IBM Lotus Notes

CVE-2012-4846

IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, aka SPRs JMAS7TRNLN and SRAO8U3Q68.

Vulnerability class: Information Disclosure

EPSS: 0.012 (66.2th percentile) — read the EPSS interpretation.

Affected products

Ibm Lotus_notes — versions 8.5.0.0, 8.5.0.1, 8.5.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@us.ibm.com (vdb-entry, x_refsource_XF)
psirt@us.ibm.com (x_refsource_CONFIRM, Patch)
psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)