CVE-2014-8775: Infoleak
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8775?
CVE-2014-8775 is classified as a medium severity vulnerability due to its potential for cookie theft through remote scripts.
How do I fix CVE-2014-8775?
To fix CVE-2014-8775, update your MODX Revolution installation to version 2.2.15 or later to ensure the HTTPOnly flag is set on session cookies.
What systems are affected by CVE-2014-8775?
CVE-2014-8775 affects all versions of MODX Revolution prior to version 2.2.15.
What type of vulnerability is CVE-2014-8775?
CVE-2014-8775 is an information disclosure vulnerability that allows attackers to access sensitive cookie data.
Are there any known exploits for CVE-2014-8775?
Yes, CVE-2014-8775 has been referenced in discussions regarding remote attacks using cross-site scripting techniques.