Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag.
Weakness
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Disclosure_management | Sap | 10.1 (including) | 10.1 (including) |