6.5
CVE-2025-27453
- EPSS 0.07%
- Veröffentlicht 03.07.2025 11:29:48
- Zuletzt bearbeitet 29.01.2026 18:02:04
- Quelle psirt@sick.de
- CVE-Watchlists
- Unerledigt
LoginThe HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Endress ≫ Meac300-fnade4 Firmware Version <= 0.16.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.205 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
|
| psirt@sick.de | 5.3 | 1.6 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
|
CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.