Описание
IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 140970.
Ссылки
- VDB EntryVendor Advisory
- Vendor Advisory
- VDB EntryVendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 9.2.0 (включая) до 9.2.14 (включая)Версия от 9.5 (включая) до 9.5.9 (включая)
Одно из
cpe:2.3:a:ibm:bigfix_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:bigfix_platform:*:*:*:*:*:*:*:*
EPSS
Процентиль: 31%
0.00114
Низкий
3.1 Low
CVSS3
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-384
Связанные уязвимости
CVSS3: 4.3
github
около 3 лет назад
IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 140970.
EPSS
Процентиль: 31%
0.00114
Низкий
3.1 Low
CVSS3
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-384