Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.0

EMC VPLEX GeoSynchrony may expose session cookie to scripts

CVE-2014-0634 · published 12 years ago
Summary

The VPLEX GeoSynchrony software does not mark a certain web cookie as HTTPOnly, so a malicious web page could read the cookie using script code. This could allow an attacker to steal session information and potentially access the system. Updating to version 5.3 or later resolves the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
emc vplex_geosynchrony 4.0
5.0
5.1
5.2
5.2.1
cpe:2.3:a:emc:vplex_geosynchrony:4.0:*:*:*:*:*:*:*
Original advisory text
EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially s...
EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.0 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published1 Apr 2014
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-0634 · NVD
Track software like this
Free during beta