CVE-2018-1480 IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed at...
MediumCVSS 5.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user session. IBM X-Force ID: 140762.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm bigfix platform | >= 9.2.0, <= 9.2.14 | No fix listed |
| ibm bigfix platform | >= 9.5, <= 9.5.9 | No fix listed |
| ibm bigfix platform | = 9.5.9 | No fix listed |
| ibm bigfix platform | = 9.2.0 | No fix listed |
| ibm bigfix platform | = 9.2.14 | No fix listed |
| ibm bigfix platform | = 9.5.0 | No fix listed |
References
- ibm-bigfix-cve20181480-xss(140762) vdb-entry vendor-advisory
- www.ibm.com vendor-advisory