CVE-2015-1993

2015-11-0822:59:02

ibm

web.nvd.nist.gov

ibm

security

qradar

incident forensics

vulnerability

cve-2015-1993

nvd

cookie security

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.002

Percentile

54.8%

JSON

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.

Affected configurations

Nvd

Node

ibmsecurity_qradar_incident_forensicsMatch7.2.0

ibmsecurity_qradar_incident_forensicsMatch7.2.1

ibmsecurity_qradar_incident_forensicsMatch7.2.2

ibmsecurity_qradar_incident_forensicsMatch7.2.3

ibmsecurity_qradar_incident_forensicsMatch7.2.4

ibmsecurity_qradar_incident_forensicsMatch7.2.5

VendorProductVersionCPE
ibmsecurity_qradar_incident_forensics7.2.0cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.0:*:*:*:*:*:*:*
ibmsecurity_qradar_incident_forensics7.2.1cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.1:*:*:*:*:*:*:*
ibmsecurity_qradar_incident_forensics7.2.2cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.2:*:*:*:*:*:*:*
ibmsecurity_qradar_incident_forensics7.2.3cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.3:*:*:*:*:*:*:*
ibmsecurity_qradar_incident_forensics7.2.4cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.4:*:*:*:*:*:*:*
ibmsecurity_qradar_incident_forensics7.2.5cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	security_qradar_incident_forensics	7.2.0	cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.0:::::::*
ibm	security_qradar_incident_forensics	7.2.1	cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.1:::::::*
ibm	security_qradar_incident_forensics	7.2.2	cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.2:::::::*
ibm	security_qradar_incident_forensics	7.2.3	cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.3:::::::*
ibm	security_qradar_incident_forensics	7.2.4	cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.4:::::::*
ibm	security_qradar_incident_forensics	7.2.5	cpe:2.3:a:ibm:security_qradar_incident_forensics:7.2.5:::::::*