CVE-2015-7427

Опубликовано: 14 нояб. 2015

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*

Версия до 6.0.0.16 (включая)

cpe:2.3:a:ibm:datapower_gateway:6.0.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.4:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.6:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.7:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.8:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.9:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.10:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.11:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.12:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.13:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.14:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.15:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:6.0.1.16:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.4:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.6:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.7:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.8:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.0.0.9:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.1.0.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.1.0.4:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.1.0.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.1.0.6:*:*:*:*:*:*:*

cpe:2.3:a:ibm:datapower_gateway:7.2.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00225

Низкий

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-xc6q-4cv7-5wqw

github

больше 3 лет назад