Unscored severity · published Aug 9, 2011
CVE-2011-2224
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Data Synchronizer · Novell
1.0.0; 1.1.0; 1.1.1; 1.1.2 · source: NVD
MP
Mobility Pack · Novell
through 1.1.2; 1.0; 1.1; 1.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2224
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2224
Vendor Advisory
http://secunia.com/advisories/45527
Vendor Advisory
http://www.novell.com/support/viewContent.do?externalId=7009058
www.securityfocus.com
http://www.securityfocus.com/bid/49069
More from Data Synchronizer
–
CVE-2011-3014
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not properly restrict caching of HTTPS responses, which makes it easier for remote…
–
CVE-2011-3013
WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 supports weak SSL ciphers, which makes it easier for remote attackers to obtain…
–
CVE-2011-2223
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the Admin LDAP password in cleartext, which allows remote attackers to obtain sensitive…
–
CVE-2011-2222
Session fixation vulnerability in WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to hijack web sessions…
–
CVE-2011-2221
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to bypass WebAdmin authentication and obtain sensitive GroupWise…