CVE-2022-25172CWE-1004

An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4

High · published May 12, 2022

CVSS v3.0
7.5
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the session cookie.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01035 · 63.6th percentile
Weakness
CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag
Published
2022-05-12T17:01Z
EPSS history
Timeline
  • 12 MAY 17:01Z
    An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4
    cvelistv5