CVE-2016-5409: Infoleak
It is reported that when OpenShift Enterprise 2 creates the GEARID cookie it fails to set the HTTPONLY valud on the cookie making it possible for attackers to read the cookie through other flaws.
Other sources
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5409?
CVE-2016-5409 has a moderate severity rating due to potential cookie exposure.
How do I fix CVE-2016-5409?
To fix CVE-2016-5409, update Red Hat OpenShift Enterprise to a version that sets the HTTPOnly flag on the GEARID cookie.
What impact does CVE-2016-5409 have on my application?
The impact of CVE-2016-5409 allows attackers to read the GEARID cookie through other vulnerabilities.
Is CVE-2016-5409 a remote or local vulnerability?
CVE-2016-5409 is primarily a local vulnerability that can be exploited under certain conditions.
Which versions of OpenShift are affected by CVE-2016-5409?
CVE-2016-5409 affects Red Hat OpenShift version 2.0.