HCL Unica Platform Cookie Without HTTPOnly Flag Vulnerability

A vulnerability exists in HCL Unica Platform versions 25.1 and below, where cookies are set without the HTTPOnly flag. This omission allows malicious agents to potentially manipulate cookie data by directing users to click on harmful links, either directly or through a third-party website.

Impact

Exploitation of this vulnerability could lead to cross-site scripting attacks, where an attacker injects malicious scripts that are executed in the context of the user's browser.

Remediation

To address this vulnerability, the HTTPOnly and Secure flags should be added to the Set-Cookie header. This can be done by modifying the web server configuration file, such as httpd.conf for Apache or the equivalent for IBM HTTP Server.