PT-2014-5083 · Ibm · Ibm Rational Quality Manager+1

Publicado 2014-09-12 · Atualizado 2017-08-29 · CVE-2014-3092

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Jazz Team Server versions prior to 3.0.1.6 iFix 3 Rational Quality Manager versions 3.x before 3.0.1.6 iFix 3 Rational Quality Manager versions 4.x before 4.0.7 Rational Quality Manager versions 5.x before 5.0.1

Description The issue allows remote attackers to capture session cookies by intercepting their transmission within an http session, as the secure flag for the session cookie in an https session is not set.

Recommendations For IBM Jazz Team Server versions prior to 3.0.1.6 iFix 3, update to version 3.0.1.6 iFix 3 or later. For Rational Quality Manager versions 3.x before 3.0.1.6 iFix 3, update to version 3.0.1.6 iFix 3 or later. For Rational Quality Manager versions 4.x before 4.0.7, update to version 4.0.7 or later. For Rational Quality Manager versions 5.x before 5.0.1, update to version 5.0.1 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-3092

Produtos afetados

Ibm Jazz Team Server

Ibm Rational Quality Manager

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/94258 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3092 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21682787 · Aviso do Fabricante