BLU-IC2 and BLU-IC4 HTTP Security Misconfiguration Vulnerability Allowing Cookie Access via JavaScript

A security misconfiguration vulnerability has been identified in BLU-IC2 and BLU-IC4 products, both through version 1.19.5. The issue arises from a lack of proper security attributes, such as 'Secure' and 'HttpOnly', on cookies. This misconfiguration may enable the reading of sensitive cookies through the JavaScript context.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive cookie data, which may include session tokens or other critical information, depending on the application's use of cookies.