In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookies value to be read or set by client-side JavaScript.
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wha-gw-f2d2-0-as-z2-eth_firmware | Pepperl-fuchs | 3.0.8 (including) | 3.0.8 (including) |
| Wha-gw-f2d2-0-as-z2-eth_firmware | Pepperl-fuchs | 3.0.9 (including) | 3.0.9 (including) |