PT-2012-1360 · Websense · Websense Web Security/Web Filter

Publicado 2012-08-23 · Atualizado 2017-08-29 · CVE-2010-5148

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Websense Web Security and Web Filter versions prior to 7.1 Hotfix 21

Description The issue allows remote attackers to capture the Encrypted Session (SSL) cookie by intercepting its transmission within an http session, as the secure flag is not set for this cookie in an https session.

Recommendations For versions prior to 7.1 Hotfix 21, update to version 7.1 Hotfix 21 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information transmitted over https sessions until the update is applied.

Correção

Identificadores relacionados

CVE-2010-5148

Produtos afetados

Websense Web Security/Web Filter

Referências · 4

• http://websense.com/content/support/library/web/v711/ws711_known_issues/first.aspx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-5148 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78342 · Nota
• http://websense.com/content/support/library/web/v711/ws711_known_issues/ws711_known_issues.pdf · Aviso do Fabricante