IbmCVELIST:CVE-2018-1480CVE-2018-1480
4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:H/RL:O/RC:C
0.001 Low
EPSS
Percentile
28.8%
IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the ‘HttpOnly’ attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user session. IBM X-Force ID: 140762.
CNA Affected
[
{
"product": "BigFix Platform",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "9.5.9"
},
{
"status": "affected",
"version": "9.2.0"
},
{
"status": "affected",
"version": "9.2.14"
},
{
"status": "affected",
"version": "9.5.0"
}
]
}
]Related
4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:H/RL:O/RC:C
0.001 Low
EPSS
Percentile
28.8%