CVE-2014-0174

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise MRG 2.5

Description The issue allows remote attackers to obtain potentially sensitive information via script access to a session cookie. This is because the HTTPOnly flag is not included in the Set-Cookie header for the session cookie.

Recommendations For Red Hat Enterprise MRG 2.5, consider configuring the application to include the HTTPOnly flag in the Set-Cookie header for the session cookie to prevent script access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.