CVE-2015-5183: High severity red hat amq vulnerability
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
Other sources
It was found that A-MQ's Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user.
— Red Hat
It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2015-5183?
CVE-2015-5183 is classified as a High severity vulnerability due to its impact on sensitive cookie attributes.
How do I fix CVE-2015-5183?
To fix CVE-2015-5183, update Red Hat AMQ to version 6.3 or later to ensure HTTPOnly and Secure attributes are properly set on cookies.
What are the risks associated with CVE-2015-5183?
Exploitation of CVE-2015-5183 can allow attackers to access authenticated session IDs and potentially conduct further malicious actions.
Which versions of Red Hat AMQ are affected by CVE-2015-5183?
CVE-2015-5183 affects Red Hat AMQ versions prior to 6.3.
Do I need to take action if I'm using JBoss A-MQ version 7 regarding CVE-2015-5183?
If using JBoss A-MQ version 7, you should verify if you are also using components that may be impacted by CVE-2015-5183, even though version 7 itself is not directly affected.