Pinpoint through version 3.1.0 is affected by a vulnerability involving insecure session cookie attributes. The pinpointJwt session cookie is missing the HttpOnly and Secure flags, which permits JavaScript access through document.cookie and allows the cookie to be transmitted in cleartext over HTTP connections. Attackers can leverage stored or reflected cross-site scripting vulnerabilities to steal the session token or intercept it via network sniffing, enabling session hijacking. The CVSS 4.0 base score is 7.6, reflecting network attack vector, high impact on confidentiality and integrity, and requiring user interaction with high attack complexity.

Attackers can access the pinpointJwt session cookie via JavaScript or intercept it over unencrypted HTTP, enabling session hijacking. This compromises user session confidentiality and integrity, potentially allowing unauthorized access to user accounts or sensitive data within the pinpoint application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating risks by enforcing HTTPS to prevent cookie interception and applying security controls to prevent cross-site scripting vulnerabilities that could expose the cookie via JavaScript.