CVE-2004-0462 json
The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which cou…
published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-0461
- cvss
- 2.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the same server.
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
References
-
exchange.xforce.ibmcloud.com
/vulnerabilities/17702
vdb-entry
-
kb.cert.org
/vuls/id/546483
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2004-0462
- NVD CVE-2004-0462
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.