CVE-2019-25091

CVE-2019-25091 is a medium-severity vulnerability affecting nsupdate.info, specifically within the CSRF Cookie Handler component. It stems from improper handling of the CSRF_COOKIE_HTTPONLY argument in src/nsupdate/settings/base.py, leading to a cookie being set without the 'httponly' flag. This allows for remote exploitation, potentially enabling an attacker to access sensitive cookie information. The CVSS score of 5.3 (Medium) indicates a network-based attack with low complexity, requiring no user interaction, and resulting in low confidentiality impact. While the EPSS score is very low, suggesting minimal exploitability in the wild, the FAUCET Risk Score of 19/100 indicates some level of concern. Currently, there is no evidence of active exploitation, and no public exploit code exists in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also absent, which is typical for the vast majority of vulnerabilities. A patch (60a3fe559c453bc36b0ec3e5dd39c1303640a59a) is available to remediate this issue.