CVE-2015-5183

high

Published 2017-09-25 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.5

Description

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.

Predictions

Exploit likelihood

83%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ Red Hat statement This flaw affects only the Red Hat AMQ Product, and does not impact Apache ActiveMQ. Errata / fixed releases ProductPackageAdvisoryReleased Red Hat AMQRHSA-2020:41542020-10-01T00:00:00Z Red Hat AMQRHSA-2020:53652020-12-08T00:00:00Z Red Hat JBoss A-MQ 6.3RHSA-2018:28402018-10-01T00:00:00Z Red…

Description

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

Red Hat statement

This flaw affects only the Red Hat AMQ Product, and does not impact Apache ActiveMQ.

Errata / fixed releases

Product	Advisory	Released
Red Hat AMQ	RHSA-2020:4154	2020-10-01T00:00:00Z
Red Hat AMQ	RHSA-2020:5365	2020-12-08T00:00:00Z
Red Hat JBoss A-MQ 6.3	RHSA-2018:2840	2018-10-01T00:00:00Z
Red Hat JBoss Fuse 6.3	RHSA-2018:2840	2018-10-01T00:00:00Z

Package state

Product	Package	State
Red Hat AMQ Broker 7	`Hawtio`	Affected

Affected

Vendor	Product	Version
redhat	Red Hat AMQ Broker 7	`Affected`

Application impact

Vendor	Product	Versions	Fixed
redhat	amq	`{"endExcluding":"6.3"}`	`6.3`
redhat	jboss_a-mq	`7`
redhat	jboss_enterprise_web_server	`1.0.0`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.