PT-2019-7904 · Ibm · Ibm Bigfix Compliance

Published 2019-02-05 · Updated 2019-10-09 · CVE-2017-1198

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM BigFix Compliance versions 1.7 through 1.9.91

Description The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorized parties gain access to the URLs through server logs, referrer headers, or browser history.

Recommendations For IBM BigFix Compliance versions 1.7 through 1.9.91, consider modifying the application to store sensitive information in a more secure manner, such as using secure cookies or tokens, to prevent exposure through URL parameters. As a temporary workaround, restrict access to server logs and ensure that browser history is properly secured to minimize the risk of unauthorized access to sensitive information.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2017-1198

Affected Products

Ibm Bigfix Compliance

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-1198 · Security Note
• https://www-01.ibm.com/support/docview.wss?uid=ibm10737581 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1198 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/123673 · Vendor Advisory