CVE-2013-7436
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it...
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Exploit likelihood
What each source reports
NVD Score used
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Record
CVE-2013-7436- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Record
CVE-2013-7436- Updated
- 2026-11-02
EUVDEUVD-2013-7200 No score
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Record
EUVD-2013-7200- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-85jr-wq3p-ggcq No score
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it...
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Record
GHSA-85jr-wq3p-ggcq- Updated
- 2026-11-02
OSV No score
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Record
CVE-2013-7436- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-7436 No score
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Record
DEBIAN-CVE-2013-7436- Updated
- 2026-11-02
OSVMGASA-2015-0133 No score
Updated novnc packages fix CVE-2013-7436
Updated novnc package fixes security vulnerability:
noVNC before 0.5.1 allows an attacker to steal insecurely set session token cookies, hijacking active or inactive VNC sessions (CVE-2013-7436).
- Record
MGASA-2015-0133- Updated
- 2026-11-02
OSVSUSE-SU-2015:1300-1 No score
Security update for novnc
novnc was updated to fix a session hijacking problem through insecurely set session token cookies (bnc#922233, CVE-2013-7436).
Security Issues:
* CVE-2013-7436
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7436>
- Record
SUSE-SU-2015:1300-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-7436 No score
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Record
UBUNTU-CVE-2013-7436- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
novncDebian:12 |
before 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 | 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 |
novncDebian:13 |
before 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 | 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 |
novncDebian:14 |
before 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 | 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 |
novncMageia:4 |
before 0.4-9.2.mga4 | 0.4-9.2.mga4 |
novncRed Hat:openstack:6::el7 |
before 0:0.5.1-2.el7ost | 0:0.5.1-2.el7ost |
novncRed Hat:openstack:5::el6 |
before 0:0.5.1-2.el6ost | 0:0.5.1-2.el6ost |
novncRed Hat:openstack:5::el7 |
before 0:0.5.1-2.el7ost | 0:0.5.1-2.el7ost |
novncRed Hat:openstack:4::el6 |
before 0:0.5.1-2.el6ost | 0:0.5.1-2.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7436 is a medium vulnerability (CVSS 4.3) in Kanaka Novnc, published April 4, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.17%, the 82nd percentile. Fixed in novnc 1:0.4+dfsg+1+20131010+gitf68af8af3d-4.
References
openwall.com/lists/oss-security/2015/02/17/1
rhn.redhat.com/errata/RHSA-2015-0833.html
bugzilla.redhat.com/show_bug.cgi?id=1193451
github.com/kanaka/noVNC/commit/ad941faddead705cd611921730054767a0b32dcd
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-7436
security-tracker.debian.org/tracker/CVE-2013-7436
advisories.mageia.org/MGASA-2015-0133.html
bugs.mageia.org/show_bug.cgi?id=15481
access.redhat.com/errata/RHSA-2015:0788
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0788.json
cve.org/CVERecord?id=CVE-2013-7436
suse.com/support/update/announcement/2015/suse-su-20151300-1
bugzilla.suse.com/922233
ubuntu.com/security/CVE-2013-7436