PT-2019-7904 · Ibm · Ibm Bigfix Compliance

Publicado 2019-02-05 · Atualizado 2019-10-09 · CVE-2017-1198

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM BigFix Compliance versions 1.7 through 1.9.91

Description The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorized parties gain access to the URLs through server logs, referrer headers, or browser history.

Recommendations For IBM BigFix Compliance versions 1.7 through 1.9.91, consider modifying the application to store sensitive information in a more secure manner, such as using secure cookies or tokens, to prevent exposure through URL parameters. As a temporary workaround, restrict access to server logs and ensure that browser history is properly secured to minimize the risk of unauthorized access to sensitive information.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2017-1198

Produtos afetados

Ibm Bigfix Compliance

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-1198 · Nota de Segurança
• https://www-01.ibm.com/support/docview.wss?uid=ibm10737581 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1198 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/123673 · Aviso do Fabricante