CVE-2021-40649

MediumCVSS 6.5

Published: 14/06/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

51th percentile - higher than 51% of all known CVEs

Summary

In Connx version 6.2.0.1269 (20210623), a cookie can be issued by the application without the HttpOnly flag set. The absence of this flag allows potential client-side script access to the cookie.

Risk Assessment

The risk involves possible session theft via XSS attacks, which could lead to unauthorized access to application data or functionality.

Recommendation

It is recommended to update Connx to the latest version where this setting is fixed, or manually configure the HttpOnly flag for all cookies issued by the application.

Original NVD description (English source)

In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.