CVE-2012-4846

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-12-19 · updated 2026-06-16
Weakness: CWE-200

Description

IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, aka SPRs JMAS7TRNLN and SRAO8U3Q68.

Affected products

IBM Lotus Notes: 8.5.0.0, 8.5.0.1, 8.5.1, 8.5.1.0, 8.5.1.1, 8.5.1.2 (+10)

References

http://www.ibm.com/support/docview.wss?uid=swg21619604
http://www.ibm.com/support/docview.wss?uid=swg21620361
https://exchange.xforce.ibmcloud.com/vulnerabilities/79535
http://www.ibm.com/support/docview.wss?uid=swg21619604
http://www.ibm.com/support/docview.wss?uid=swg21620361
https://exchange.xforce.ibmcloud.com/vulnerabilities/79535

Get alerted when CVE-2012-4846 or the next vulnerability affects your stack