CVE-2014-0174
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the...
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Exploit likelihood
What each source reports
NVD Score used
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
- Record
CVE-2014-0174- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
- Record
CVE-2014-0174- Updated
- 2026-11-02
EUVDEUVD-2014-0227 No score
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
- Record
EUVD-2014-0227- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p88m-27c7-422h No score
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the...
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
- Record
GHSA-p88m-27c7-422h- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0174 is a medium vulnerability (CVSS 4.3) in Redhat Enterprise Mrg, published July 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.58%, the 75th percentile. Fixed in cumin 0:0.1.5797-3.el6.
References
rhn.redhat.com/errata/RHSA-2014-0858.html
nvd.nist.gov/vuln/detail/CVE-2014-0174
github.com/advisories/GHSA-p88m-27c7-422h
access.redhat.com/errata/RHSA-2014:0858
Show 10 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=830254
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0858.json
cve.org/CVERecord?id=CVE-2012-2682