CVE-2012-4846

Published: Dec 19, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, aka SPRs JMAS7TRNLN and SRAO8U3Q68.

Affected (16)

Products: Ibm: Lotus Notes

Ibm

1 product

Lotus Notes

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Ibm Lotus Notes	Version 8.5.0.0
Ibm Lotus Notes	Version 8.5.0.1
Ibm Lotus Notes	Version 8.5.1.0
Ibm Lotus Notes	Version 8.5.1.1
Ibm Lotus Notes	Version 8.5.1.2
Ibm Lotus Notes	Version 8.5.1.3
Ibm Lotus Notes	Version 8.5.1.4
Ibm Lotus Notes	Version 8.5.1.5
Ibm Lotus Notes	Version 8.5.1
Ibm Lotus Notes	Version 8.5.2.0
Ibm Lotus Notes	Version 8.5.2.1
Ibm Lotus Notes	Version 8.5.2.2
Ibm Lotus Notes	Version 8.5.2.3
Ibm Lotus Notes	Version 8.5.3.1
Ibm Lotus Notes	Version 8.5.3.2
Ibm Lotus Notes	Version 8.5.3