CVE-2012-4846 in Lotus Notes
Summary
IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, aka SPRs JMAS7TRNLN and SRAO8U3Q68.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
09/06/2012
Disclosure
12/19/2012
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 7191 | IBM Lotus Notes Web Application information disclosure | 200 | Unproven | Official fix | CVE-2012-4846 |