CVE-2019-14849

{"containers": {"cna": {"affected": [{"product": "3scale", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-12-12T13:14:53.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:26:39.075Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2019-14849", "datePublished": "2019-12-12T13:14:53.000Z", "dateReserved": "2019-08-10T00:00:00.000Z", "dateUpdated": "2024-08-05T00:26:39.075Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "3scale", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:3scale:*:*:*:*:*:*:*:*", "matchCriteriaId": "2700E9B2-AE29-44B4-B1F2-FBC912ED0A05", "versionEndExcluding": "2.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en 3scale versi\u00f3n anterior a 2.6, no estableci\u00f3 el atributo HTTPOnly en la cookie de sesi\u00f3n del usuario. Un atacante podr\u00eda usar esto para conducir ataques de tipo cross site scripting y conseguir acceso a informaci\u00f3n no autorizada."}], "id": "CVE-2019-14849", "lastModified": "2026-06-17T02:19:09.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "secalert@redhat.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-12T14:15:15.257", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2019:2534", "cpe": "cpe:/a:redhat:3scale_amp:2", "package": "3scale-amp26/3scale-operator:1.9-7", "product_name": "3scale API Management 2.6 on RHEL 7", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2534", "cpe": "cpe:/a:redhat:3scale_amp:2", "package": "3scale-amp26/apicast-gateway:1.15-9", "product_name": "3scale API Management 2.6 on RHEL 7", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2534", "cpe": "cpe:/a:redhat:3scale_amp:2", "package": "3scale-amp26/backend:1.9-24", "product_name": "3scale API Management 2.6 on RHEL 7", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2534", "cpe": "cpe:/a:redhat:3scale_amp:2", "package": "3scale-amp26/operator:1.9-7", "product_name": "3scale API Management 2.6 on RHEL 7", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2534", "cpe": "cpe:/a:redhat:3scale_amp:2", "package": "3scale-amp26/toolbox:1.2-5", "product_name": "3scale API Management 2.6 on RHEL 7", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2534", "cpe": "cpe:/a:redhat:3scale_amp:2", "package": "3scale-amp26/zync:1.9-28", "product_name": "3scale API Management 2.6 on RHEL 7", "release_date": "2019-08-21T00:00:00Z"}], "bugzilla": {"description": "3scale: user session cookie does not set HTTPOnly", "id": "1712167", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712167"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.6", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-201", "details": ["A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.", "A flaw was found where 3scale did not set the HTTPOnly attribute on the user session cookie. An attacker could abuse this flaw to conduct Cross-site Scripting attacks and gain access to unauthorized information."], "name": "CVE-2019-14849", "public_date": "2019-12-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-14849\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-14849"], "threat_severity": "Low"}

{}