ID de Prueba:	1.3.6.1.4.1.25623.1.0.105925
Categoría:	Web application abuses
Título:	Missing 'HttpOnly' Cookie Attribute (HTTP)
Resumen:	The remote HTTP web server / application is missing to set the; 'HttpOnly' cookie attribute for one or more sent HTTP cookie.
Descripción:	Summary: The remote HTTP web server / application is missing to set the 'HttpOnly' cookie attribute for one or more sent HTTP cookie. Vulnerability Insight: The flaw exists if a session cookie is not using the 'HttpOnly' cookie attribute. This allows a cookie to be accessed by JavaScript which could lead to session hijacking attacks. Affected Software/OS: Any web application with session handling in cookies. Solution: - Set the 'HttpOnly' cookie attribute for any session cookie - Evaluate / do an own assessment of the security impact on the web server / application and create an override for this result if there is none (this can't be checked automatically by this VT) CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Copyright	Copyright (C) 2014 SCHUTZWERK GmbH

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.