CVE-2015-1915

Опубликовано: 25 мая 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg1IV72069
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21882571
Patch
Vendor Advisory
http://www.securityfocus.com/bid/74193
http://www-01.ibm.com/support/docview.wss?uid=swg1IV72069
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21882571
Patch
Vendor Advisory
http://www.securityfocus.com/bid/74193

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:endpoint_manager_family:9.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:endpoint_manager_family:9.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 51%

0.00275

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-34hj-48ww-g9qc

github

больше 3 лет назад