NVD

Id
42132  
Name
CVE-2013-7436  
Description
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2015-04-10  
Modified Date
2015-05-05  
Seq
2013-7436  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
212591 42132 CVE-2013-7436 RHSA-2015:0788  View
212592 42132 CVE-2013-7436 RHSA-2015:0833  View
212593 42132 CVE-2013-7436 RHSA-2015:0834  View
212594 42132 CVE-2013-7436 RHSA-2015:0884  View
212595 42132 CVE-2013-7436 [oss-security] 20150217 CVE request: novnc: session hijack through insecurely set session token cookies  View
212596 42132 CVE-2013-7436 [oss-security] 20150312 CVE request: novnc: session hijack through insecurely set session token cookies  View
212597 42132 CVE-2013-7436 https://bugzilla.redhat.com/show_bug.cgi?id=1193451  View
212598 42132 CVE-2013-7436 https://github.com/kanaka/noVNC/commit/ad941faddead705cd611921730054767a0b32dcd  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
25160 JVNDB-2013-006737 noVNC における Cookie をキャプチャされる脆弱性 noVNC は、https セッションの Cookie に対して secure フラグを設定しないため、Cookie をキャプチャされる脆弱性が存在します。 CVE-2013-7436 67378 CVE-2013-7436 42132 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006737.html 2013-10-28 2015-04-15 View