CVE-2020-14248

5.3MEDIUM

Key Information:

Vendor
HCL Software
Status
Hcl Bigfix Inventory
Vendor
CVE Published:
16 December 2020

Summary

BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Affected Version(s)

HCL BigFix Inventory v9, v10.0.x

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_a...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.