CVE-2015-2855

Опубликовано: 30 мая 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138.

Ссылки

http://www.kb.cert.org/vuls/id/498348
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/74921
https://bto.bluecoat.com/security-advisory/sa96
Vendor Advisory
http://www.kb.cert.org/vuls/id/498348
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/74921
https://bto.bluecoat.com/security-advisory/sa96
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:blue_coat:ssl_visibility_appliance_sv800_firmware:*:*:*:*:*:*:*:*

Версия до 3.8.3 (включая)

cpe:2.3:h:blue_coat:ssl_visibility_appliance_sv800:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:blue_coat:ssl_visibility_appliance_sv1800_firmware:*:*:*:*:*:*:*:*

Версия до 3.8.3 (включая)

cpe:2.3:h:blue_coat:ssl_visibility_appliance_sv1800:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:blue_coat:ssl_visibility_appliance_sv3800_firmware:*:*:*:*:*:*:*:*

Версия до 3.8.3 (включая)

cpe:2.3:h:blue_coat:ssl_visibility_appliance_sv3800:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:blue_coat:ssl_visibility_appliance_sv2800_firmware:*:*:*:*:*:*:*:*

Версия до 3.8.3 (включая)

cpe:2.3:h:blue_coat:ssl_visibility_appliance_sv2800:-:*:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.01827

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-xq5w-8f3v-gx7x

github

больше 3 лет назад

EPSS

Процентиль: 83%

0.01827

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-200