Concrete CMS · Report #4792

HttpOnly flag not set for cookie on concrete5.org

Validstatus

10upvotes

16 Apr 2014disclosed

How it was found

Hi,

The HttpOnly flag is not set on concrete5.org, making it easy to steal the cookie when a XSS is present on the site.

See HttpOnly on OWASP for more information.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original