CVE Vulnerabilities

CVE-2025-24318

Sensitive Cookie Without 'HttpOnly' Flag

Published: Feb 28, 2025 | Modified: Feb 28, 2025

CVSS 3.x

N/A

Source:

NVD

CVSS 2.x

RedHat/V2

RedHat/V3

Ubuntu

Additional information

NVD	https://nvd.nist.gov/vuln/detail/CVE-2025-24318
CWE	https://cwe.mitre.org/data/definitions/1004.html

Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise.

Weakness

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Potential Mitigations

References

Aqua Container Security

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.