PT-2018-12734 · Ibm · Ibm Bigfix Platform

Publicado 2018-12-12 · Atualizado 2019-10-09 · CVE-2018-1480

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM BigFix Platform versions 9.2.0 through 9.2.14 IBM BigFix Platform versions 9.5 through 9.5.9

Description The issue is related to the lack of the 'HttpOnly' attribute on authorization tokens or session cookies. This could potentially allow attackers to obtain cookie values via malicious JavaScript if a Cross-Site Scripting vulnerability also exists, leading to the hijacking of user sessions.

Recommendations For IBM BigFix Platform versions 9.2.0 through 9.2.14, set the 'HttpOnly' attribute on authorization tokens or session cookies to prevent potential session hijacking. For IBM BigFix Platform versions 9.5 through 9.5.9, set the 'HttpOnly' attribute on authorization tokens or session cookies to prevent potential session hijacking.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2018-1480

Produtos afetados

Ibm Bigfix Platform

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-1480 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1480 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/140762 · Aviso do Fabricante
• https://ibm.com/support/docview.wss?uid=ibm10733605 · Aviso do Fabricante