ID:3845 - Exploit for Information disclosure in MODX Revolution - CVE-2014-8775

Link to public exploit:

Vulnerability description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Remediation