CVE-2015-2025

Опубликовано: 04 окт. 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21966044
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21966044
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:websphere_extreme_scale:7.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_extreme_scale:7.1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_extreme_scale:7.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00254

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-x4vf-q922-8w98

github

больше 3 лет назад