CVE-2011-2154: login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cook...

Security readout for executives and security teams

SmarterStats 6.0 sets a loginsettings cookie without the HttpOnly protection. If an attacker can get script to run in a user’s browser for that site, the cookie may be readable. The sources do not show active exploitation, a CVSS score, or whether this cookie is an authentication token. Exposure is limited to organizations still running SmarterTools SmarterStats 6.0, especially if reachable by untrusted users or the internet. Evidence is incomplete for later versions or other SmarterTools products. Treat this as a targeted legacy-system hygiene issue, not an emergency based on the provided evidence. Prioritize remediation if SmarterStats 6.0 is internet-facing, still business-critical, or paired with known XSS exposure. Mitigation focus: Identify any deployed SmarterTools SmarterStats 6.0 instances.; Check SmarterTools or CERT guidance for supported updates or configuration advice.; Upgrade or retire unsupported SmarterStats deployments where feasible..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.