CVE-2019-17104

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-565

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2019/10/09/2Mailing List, Third Party Advisory
https://github.com/centreon/centreon/issues/7097Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/10/08/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/09/2Mailing List, Third Party Advisory
https://github.com/centreon/centreon/issues/7097Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/10/08/1Mailing List, Third Party Advisory

Timeline

Published: Oct 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-171055.3The token generator in index.php in Centreon Web before 2.8.27 is predictable.CVE-2019-171066.5In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external co CVE-2019-171078.8minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parame CVE-2019-171086.1Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS CVE-2019-171096.5Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.CVE-2019-17117.5A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated, remote attacker to ca CVE-2019-171124.3An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access CVE-2019-171139.8In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict th CVE-2019-171146.1A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers t CVE-2019-171156.1Multiple cross-site scripting (XSS) vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbi CVE-2019-171166.1A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to CVE-2019-171178.8A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute