Security Advisory
CVE-2014-0154
5
Vulnerability Description
oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Published Date
February 13, 2015
Official Source
NIST NVD Advisory