What is CVE-2014-3852?

CVE-2014-3852 is a vulnerability in Pyplate, classified under Information Disclosure. Published 2014-08-07.

Is CVE-2014-3852 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Pyplate

CVE-2014-3852

Pyplate 0.08 does not include the HTTPOnly flag in a Set-Cookie header for the id cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Vulnerability class: Information Disclosure

EPSS: 0.015 (71.5th percentile) — read the EPSS interpretation.

Affected products

Pyplate — versions 0.08
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

Whamo12/fetch-cwe-list
aemon1407/KWSPZapTest
alejandrosaenz117/fetch-cwe-list

References

cve@mitre.org (mailing-list, x_refsource_MLIST)
cve@mitre.org (mailing-list, x_refsource_MLIST, Exploit)

Frequently asked questions

What is CVE-2014-3852?: CVE-2014-3852 is a vulnerability in Pyplate, classified under Information Disclosure. Published 2014-08-07.
Is CVE-2014-3852 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.