CVE-2016-2304
published 2016-04-22CVE-2016-2304: Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote…
PriorityP414medium4.3CVSS 3.0
AVNACLPRNUIRSUCLINAN
EPSS
1.06%
60.5th percentile
Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ecava | integraxor | <= 4.2.4502 | — |
CVSS provenance
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Ecava IntegraXor Vulnerabilities
cisa_ics·2018-08-23
Ecava IntegraXor Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Ecava IntegraXor Vulnerabilities
Last RevisedAugust 23, 2018
Alert CodeICSA-16-105-03
## OVERVIEW
Independent security researcher Marcus Richerson and Steven Seeley of Source Incite, working with Trend Micro’s Zero Day Initiative, independently identified vulnerabilities in Ecava’s IntegraXor application. Ecava has produced a new version to mitigate these vulnerabilities. Marcus Richerson has tested the new version to validate that it resolves all the vulnerabilities, except for one incomplete fix, which Ecava plans to fully address in an upcoming release.
These vulnerabilities
GHSA
GHSA-ffr3-jpgq-h3f5: Ecava IntegraXor before 5
ghsa_unreviewed·2022-05-17
CVE-2016-2304 [MEDIUM] CWE-200 GHSA-ffr3-jpgq-h3f5: Ecava IntegraXor before 5
Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2016-04-22
Published