CVE-2011-2154: Infoleak
login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2154?
CVE-2011-2154 is classified as a medium severity vulnerability due to its potential impact on sensitive data exposure.
How do I fix CVE-2011-2154?
To fix CVE-2011-2154, configure the web application to include the HTTPOnly flag in the Set-Cookie header for the loginsettings cookie.
What is the main issue with CVE-2011-2154?
The main issue with CVE-2011-2154 is the lack of the HTTPOnly flag, which allows attackers to access sensitive information in cookies through client-side scripts.
Which software is affected by CVE-2011-2154?
CVE-2011-2154 affects SmarterTools SmarterStats version 6.0.
Can CVE-2011-2154 lead to session hijacking?
Yes, CVE-2011-2154 can lead to session hijacking as attackers can steal session cookies without the HTTPOnly safeguard.