CVE-2018-1485 IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This co...
MediumCVSS 4.3
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 140970.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm bigfix platform | >= 9.2.0, <= 9.2.14 | No fix listed |
| ibm bigfix platform | >= 9.5, <= 9.5.9 | No fix listed |
| ibm bigfix platform | = 9.5.9 | No fix listed |
| ibm bigfix platform | = 9.2.0 | No fix listed |
| ibm bigfix platform | = 9.2.14 | No fix listed |
| ibm bigfix platform | = 9.5.0 | No fix listed |
References
- ibm-bigfix-cve20181485-info-disc(140970) vdb-entry vendor-advisory
- www.ibm.com vendor-advisory