PT-2014-5083 · Ibm · Ibm Rational Quality Manager+1

Published 2014-09-12 · Updated 2017-08-29 · CVE-2014-3092

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Jazz Team Server versions prior to 3.0.1.6 iFix 3 Rational Quality Manager versions 3.x before 3.0.1.6 iFix 3 Rational Quality Manager versions 4.x before 4.0.7 Rational Quality Manager versions 5.x before 5.0.1

Description The issue allows remote attackers to capture session cookies by intercepting their transmission within an http session, as the secure flag for the session cookie in an https session is not set.

Recommendations For IBM Jazz Team Server versions prior to 3.0.1.6 iFix 3, update to version 3.0.1.6 iFix 3 or later. For Rational Quality Manager versions 3.x before 3.0.1.6 iFix 3, update to version 3.0.1.6 iFix 3 or later. For Rational Quality Manager versions 4.x before 4.0.7, update to version 4.0.7 or later. For Rational Quality Manager versions 5.x before 5.0.1, update to version 5.0.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3092

Affected Products

Ibm Jazz Team Server

Ibm Rational Quality Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-3092 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21682787 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94258 · Note