CVE-2013-7436 Information disclosure in n/a
Remote attackers can intercept session cookies due to missing secure flags, potentially leading to session hijacking in noVNC deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-7436?
CVE-2013-7436 is a medium-severity vulnerability in n/a, published on 10 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Weakness: CWE-310
Which versions are affected by CVE-2013-7436?
It affects 1 product.
Linux distribution packages (4)
novnc Red Hat:openstack:4::el6 | All versions | 0:0.5.1-2.el6ost |
novnc Red Hat:openstack:5::el6 | All versions | 0:0.5.1-2.el6ost |
novnc Red Hat:openstack:5::el7 | All versions | 0:0.5.1-2.el7ost |
novnc Red Hat:openstack:6::el7 | All versions | 0:0.5.1-2.el7ost |
Products include Kanaka Novnc.
How do I fix CVE-2013-7436?
Upgrade to a fixed version.
Is CVE-2013-7436 being exploited?
There is no known exploitation of CVE-2013-7436 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2013-7436, GHSA-85jr-wq3p-ggcq, MGASA-2015-0133, RHSA-2015:0788, RHSA-2015:0833, RHSA-2015:0834 and 2 more.