CVE-2018-1484

CWE-3843 documents3 sources
Severity
3.7LOW
EPSS
0.1%
top 65.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Bigfix Platform
Timeline
PublishedDec 12
Latest updateMay 13

Description

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 140969.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages2 packages

▶NVDibm/bigfix_platform9.2.0 — 9.2.14+1
▶CVEListV5ibm/bigfix_platform4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-53gf-ghfj-qq63: IBM BigFix Platform 9↗2022-05-13
▶
CVEList
CVE-2018-1484: IBM BigFix Platform 9↗2018-12-12
▶
CVE-2018-1484 (LOW CVSS 3.7) | IBM BigFix Platform 9.2.0 through 9 | cvebase.io