Description
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Remediation
References
Related Vulnerabilities
WordPress Plugin Kento Post View Counter Multiple Vulnerabilities (2.8)
SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2021-24066)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1725)
MongoDb Improper Input Validation Vulnerability (CVE-2020-7925)
Django Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2022-23833)