PT-2025-42917

CVE-2025-12031

Published

2025-10-21

Updated

2025-11-07

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BLU-IC2 versions through 1.19.5 BLU-IC4 versions through 1.19.5

Description A security misconfiguration exists due to the absence of the Secure and HTTPOnly attributes, potentially allowing sensitive cookies to be read from the JavaScript context.

Recommendations Ensure the Secure and HTTPOnly attributes are implemented for all cookies in BLU-IC2 versions through 1.19.5. Ensure the Secure and HTTPOnly attributes are implemented for all cookies in BLU-IC4 versions through 1.19.5.

Exploitability

Fix

Researchers

Vendors

Affected products

Weakness enumeration

CWE-1004: Sensitive Cookie Without \'HttpOnly\' Flag