CVE-2014-0174: Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly fl...

Security readout for executives and security teams

CVE-2014-0174 is a session-cookie protection weakness in Cumin, also known as MRG Management Console, as used in Red Hat Enterprise MRG 2.5. The session cookie was set without the HTTPOnly flag, making it easier for browser-executed scripts to read it and potentially expose a logged-in user’s session. Likely exposure is limited to environments running Red Hat Enterprise MRG 2.5 with the Cumin/MRG Management Console. Risk is higher where the management console is reachable by many users or browsers with untrusted script exposure. Treat this as a targeted legacy-platform hygiene issue, not an internet-wide emergency based on the provided evidence. Prioritize it if Red Hat Enterprise MRG 2.5 remains in use, especially for administrative consoles reachable beyond trusted administrators. Mitigation focus: Review Red Hat advisories RHSA-2014:0858 and RHSA-2014:0859 for vendor-supported remediation.; Apply the relevant Red Hat-supported updates if those advisories apply to your MRG deployment.; Inventory and retire unsupported Red Hat Enterprise MRG 2.5 management console instances..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.