CVE-2018-1480

4MEDIUM

Key Information:

Vendor
IBM
Status
Bigfix Platform
Vendor
CVE Published:
12 December 2018

Summary

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user session. IBM X-Force ID: 140762.

Affected Version(s)

BigFix Platform 9.5.9

BigFix Platform 9.2.0

BigFix Platform 9.2.14

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/140762
vdb-entryx_refsource_XF
https://www.ibm.com/support/docview.wss?uid=ibm10733605
x_refsource_CONFIRM

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.