PT-2012-1360 · Websense · Websense Web Security/Web Filter

Published 2012-08-23 · Updated 2017-08-29 · CVE-2010-5148

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Websense Web Security and Web Filter versions prior to 7.1 Hotfix 21

Description The issue allows remote attackers to capture the Encrypted Session (SSL) cookie by intercepting its transmission within an http session, as the secure flag is not set for this cookie in an https session.

Recommendations For versions prior to 7.1 Hotfix 21, update to version 7.1 Hotfix 21 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information transmitted over https sessions until the update is applied.

Fix

Related Identifiers

CVE-2010-5148

Affected Products

Websense Web Security/Web Filter

References · 4

• http://websense.com/content/support/library/web/v711/ws711_known_issues/first.aspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-5148 · Security Note
• http://websense.com/content/support/library/web/v711/ws711_known_issues/ws711_known_issues.pdf · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78342 · Note