CVE-2012-4846: Infoleak
IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, aka SPRs JMAS7TRNLN and SRAO8U3Q68.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4846?
CVE-2012-4846 is considered a medium severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2012-4846?
To fix CVE-2012-4846, upgrade to IBM Lotus Notes version 8.5.3 FP3 or later.
What specific issue does CVE-2012-4846 address?
CVE-2012-4846 addresses the lack of the HTTPOnly flag in the Set-Cookie header, which can lead to cookie theft.
Which versions of IBM Lotus Notes are affected by CVE-2012-4846?
CVE-2012-4846 affects IBM Lotus Notes versions 8.5.0.0 through 8.5.2.3.
What are the potential risks associated with CVE-2012-4846?
The potential risks of CVE-2012-4846 include unauthorized access to session cookies and exposure of sensitive information.