DerScanner
Home / Vulnerability Database / ABAP : Cookie: not HttpOnly
ABAP

ABAP : Cookie: not HttpOnly

Classification

OWASP Top 10 2013
A2-Broken Authentication and Session Management
OWASP Mobile Top 10 2016
M2-Insecure Data Storage
OWASP Top 10 2017
A2-Broken AuthenticationA3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure DesignA7-Identification and Authentication Failures
OWASP ASVS
Session Management
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (e)(1)
CWE
CWE-732CWE-1004CWE-1028
CWE/SANS Top 25 2011
CWE-732
CWE/SANS Top 25 2021
CWE-732

Overview

The application creates cookies without setting the HTTPonly flag to true This gives access to the cookies not only via the HTTP protocol (e.g., via JavaScript code), which can violate its confidentiality.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2017-A2-Broken Authentication
  2. OWASP Top 10 2013-A5-Security Misconfiguration
  3. Activating HTTP Security Session Management on AS ABAP
  4. CWE-1004
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication
MEDIUM

DerScanner Severity Score

Do you want to fix ABAP : Cookie: not HttpOnly in your application?

See also

ABAP

ABAP : Insufficient authorization check

ABAP

ABAP : Empty password

ABAP

ABAP : Weak seed of random number generator