Vulnerability Details CVE-2015-3319
Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 59.1%
CVSS Severity
CVSS v2 Score 5.0
References
- http://packetstormsecurity.com/files/131297/HotExBilling-Manager-73-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2015/Apr/18
- http://www.securityfocus.com/archive/1/535186/100/0/threaded
- http://www.securityfocus.com/bid/74205
- http://packetstormsecurity.com/files/131297/HotExBilling-Manager-73-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2015/Apr/18
- http://www.securityfocus.com/archive/1/535186/100/0/threaded
- http://www.securityfocus.com/bid/74205
Products affected by CVE-2015-3319
-
cpe:2.3:a:hotspotexpress:hotex_billing_manager:73.0