CVE-2025-27453
BaseFortify
Publication date: 2025-07-03
Last updated on: 2026-01-29
Assigner: SICK AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| endress | meac300-fnade4_firmware | to 0.16.0 (inc) |
| endress | meac300-fnade4 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1004 | The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because the HttpOnly flag is set to false on the PHPSESSION cookie. As a result, the cookie can be accessed by client-side scripts such as JavaScript, which increases the risk of the cookie being stolen or manipulated through cross-site scripting (XSS) attacks.
How can this vulnerability impact me? :
Since the PHPSESSION cookie is accessible via JavaScript, an attacker could potentially steal the session cookie through XSS attacks, leading to session hijacking. This could allow unauthorized access to a user's session and sensitive information, compromising confidentiality.