PT-2020-16092

CVE-2020-25473

·

Published

2020-11-24

·

Updated

2020-11-30

Description by

CVSS 3.1
6.5
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions SimplePHPscripts News Script PHP Pro version 2.3
Description The issue is related to the improper setting of the HttpOnly Flag from Session Cookies. This could potentially allow unauthorized access to session cookies.
Recommendations For SimplePHPscripts News Script PHP Pro version 2.3, consider updating the session cookie settings to include the HttpOnly Flag to prevent JavaScript access. As a temporary workaround, restrict access to session cookies until a proper fix is applied.
Exploitability
Fix
Vendors
Affected products
Related identifiers
CVE-2020-25473
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com