GHSA-j224-7qr4-8646

Centreon Does Not Set HTTPOnly Flag

Source: GitHub Advisory Database (reviewed) High CVE-2019-17104

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	centreon/centreon	<= 19.04.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-17104 advisory
https://github.com/centreon/centreon-archived/issues/7097 web
https://docs.centreon.com/current/en/administration/secure-platform.html#securing-the-apache-web-server web
https://github.com/centreon/centreon-archived package
https://www.openwall.com/lists/oss-security/2019/10/08/1 web