{"id":"CVE-2010-4312","published":"2010-11-26T19:00:00Z","modified":"2024-08-07T03:43:14Z","title":"The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes…","vendor":null,"product":null,"tier":"tail","description":{"text":"The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02136,"percentile":0.81887,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/archive/1/514866/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":16.38}]},"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=6.0.0, <6.0.35"],"patched":["6.0.35"],"from":["GHSA-pvjh-7h8q-q56r"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4827","exploited":false,"provenance":"source"}}